MEDIUM 4.3 NVD
CVE-2026-111453
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued eve
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.
References
- https://github.com/apache/airflow/pull/74839
- https://lists.apache.org/thread.html/z212137tkfobdgl0hnos7qg6w6r1mxw5
- https://www.cve.org/CVERecord?id=CVE-2026-75157
- https://www.openwall.com/lists/oss-security/2026/11/09/16
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.