0.0
NA
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter
Description

Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

INFO

Published Date :

Sept. 21, 2026, 2:32 p.m.

Last Modified :

Sept. 21, 2026, 2:32 p.m.

Remotely Exploit :

No

Source :

apache
Affected Products

The following products are affected by CVE-2026-75158 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Apache airflow
Solution
Unauthorized users can view asset events for DAGs they are not authorized to access. Upgrade to Apache Airflow 3.3.2 or later.
  • Upgrade Apache Airflow to version 3.3.2 or later.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-75158 vulnerability anywhere in the article.

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.