CVE Feed

    Dashboard / CVE / CVE-2026-75157

    CVE-2026-75157

    Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

    Published:Sep 18, 2026
    Last Modified:Sep 22, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.00172
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Airflow

    Exploits

    https://github.com/licitrasimone/cve-2026-75157-poc

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-86473 (CVSS 9.1) — Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When…
    CVE-2026-75158 (CVSS 4.3) — Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter re…
    CVE-2026-82355 (CVSS 4.2) — When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` t…
    CVE-2026-59244 (CVSS 6.5) — Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered …
    CVE-2026-58076 (CVSS 8.8) — Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam…
    CVE-2026-59242 (CVSS 5.4) — Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal …
    CVE-2026-54183 (CVSS 4.3) — Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U…
    CVE-2026-67260 (CVSS 7.3) — Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe…
    CVE-2026-67587 (CVSS 8.8) — Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic…
    CVE-2026-65017 (CVSS 6.5) — Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-75157 — Apache (High 7.5) | CVE-DB