Access Control Flaw in Apache Airflow’s Asset Management

CVE-2026-111453

What is CVE-2026-111453?

An access control vulnerability in Apache Airflow's API allows an authenticated user with edit permissions on a specific Directed Acyclic Graph (DAG) to delete queued events for multiple Dags to which they have read access. This flaw stems from inadequate permission verification on the dag_id parameter when triggered by API calls. Users who previously updated to Apache Airflow version 3.3.2 as a fix for a related issue remain exposed, and they are advised to upgrade to version 3.4.0 or later to mitigate this vulnerability.

References