CVE-2026-75158: Apache Airflow Asset Events API Lacks Per-Dag Authorization Filter
Summary
CVE-2026-75158: Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Affects airflow versions < 3.3.2. Fixed in 3.3.2. How to fix ↓
Also tracked for
- apache-airflow · PyPI
The same CVE-2026-75158 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to manage complex data pipelines with ease. However, the platform's asset events API has a significant security flaw that exposes sensitive information across different Dags without proper authorization checks.
Vulnerability Detail
The vulnerability arises from the /assets/events API in Apache Airflow, which returns asset events for every Dag in the deployment without any authorization filter. This means that any authenticated user with asset-read access can enumerate asset events, including sensitive details such as source Dag ID, task ID, run ID, and event timestamps for Dags they should not have access to. The absence of a filter in the count query also allows unauthorized users to discover hidden Dags, posing a risk to data confidentiality and integrity.
How To Fix
Minimum fixed version
3.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability without upgrading to the patched version. It is recommended to restrict access to the API until the upgrade can be performed.
Conclusion
In summary, CVE-2026-75158 is a critical vulnerability in Apache Airflow that exposes sensitive asset event information due to a lack of authorization filters. It is essential to upgrade to version 3.3.2 or later to mitigate this risk effectively.
See every vulnerability recorded for airflow →
FAQ
CVE-2026-75158 is a vulnerability in Apache Airflow that allows unauthorized users to access asset events across all Dags due to the lack of per-Dag authorization filters.
Any deployment of Apache Airflow that utilizes per-Dag access control is affected, particularly those that separate teams or tenants.
The risks include unauthorized access to sensitive information, potential data leaks, and the ability for users to enumerate Dags they should not have visibility into.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, consider restricting access to the API and monitoring for any unauthorized access attempts.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
