CVE-2026-75158
Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter
Description
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
INFO
Published Date :
Sept. 21, 2026, 2:32 p.m.
Last Modified :
Sept. 21, 2026, 2:32 p.m.
Remotely Exploit :
No
Source :
apache
Solution
- Upgrade Apache Airflow to version 3.3.2 or later.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-75158 vulnerability anywhere in the article.