Information Disclosure in Apache Airflow's Asset API Endpoints
CVE-2026-111454

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Airflow
Vendor
CVE Published:
9 November 2026

What is CVE-2026-111454?

The asset API endpoints of Apache Airflow reveal the IDs of Directed Acyclic Graphs (DAGs) that are associated with assets, without proper access control checks. This vulnerability allows an authenticated user with read access to assets to gain visibility into DAG IDs they should not have access to, potentially exposing sensitive operational workflows. It is recommended that users upgrade to version 3.4.0 or later to ensure appropriate safeguards are in place.

Affected Version(s)

Apache Airflow 0 < 3.4.0

References

https://github.com/apache/airflow/pull/74836
patch
https://lists.apache.org/thread.html/9n0sxown9kcjkc6pcx4z...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhixi "Jace" Sun, independent security researcher
Jarek Potiuk
.