CVE-2026-75158
Received Received - Intake

Information Disclosure in Apache Airflow

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Apache Software Foundation

Description
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-75158
EUVD
EUVD-2026-83944

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache airflow From 3.3.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Airflow allows authenticated users with asset-read access to view asset events for all DAGs, not just those they are authorized to read. The `/assets/events` API endpoint did not filter results by DAG permissions, exposing sensitive details like source DAG ID, task ID, run ID, and event timestamps. This issue affects deployments using per-DAG access control to separate teams or tenants.

Detection Guidance

To detect this vulnerability, check Apache Airflow logs for unauthorized access attempts to the /assets/events API endpoint. Monitor for requests querying asset events across multiple DAGs by non-admin users. Use network traffic analysis tools to inspect API calls to /api/v2/assets/events for unexpected data exposure.

Impact Analysis

An attacker with asset-read access could enumerate hidden DAGs and their events, revealing sensitive workflow details. Pagination metadata also disclosed the existence of unauthorized DAGs. This could lead to data leaks, unauthorized access to workflows, or exposure of sensitive operational information.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data to unauthorized users. GDPR and HIPAA mandate strict access controls and data protection; unauthorized access to workflow events may result in non-compliance, potential fines, or legal consequences.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.2 or later immediately. Review user permissions to ensure only authorized users have asset-read access. Monitor for any suspicious activity related to DAG enumeration or asset event access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart