CVE-2026-75158
Description
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
How to fix
- apache airflow3.3.2 or later
- apache-airflow3.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache airflow | v < 3.3.2 | 3.3.2 |
| apache-airflowPyPI | v < 3.3.2 | 3.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.