Vulnerability Description
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | < 3.3.2 |
Related Weaknesses (CWE)
References
- https://github.com/apache/airflow/pull/71741Issue TrackingVendor Advisory
- https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fyMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/09/21/3Mailing ListThird Party Advisory
FAQ
What is CVE-2026-75158?
CVE-2026-75158 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holdin...
How severe is CVE-2026-75158?
CVE-2026-75158 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75158?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.