Improper Permissions in Apache Airflow Allows Unauthorized Deletion of Queued Events

CVE-2026-75157

What is CVE-2026-75157?

The vulnerability in Apache Airflow arises from an oversight in permission checks for the asset queued-events DELETE endpoints. Instead of validating the caller's Dag-axis permission for EDIT, it incorrectly checks for READ permission. This allows any authenticated user with read access to a Dag to delete the queued asset events associated with that Dag, potentially disrupting scheduled asset-triggered actions. This issue becomes particularly critical in deployments where asset-triggered scheduling is actively utilized, and the misconfiguration of permissions is prevalent. To mitigate this vulnerability, upgrading to Apache Airflow version 3.3.2 or later is highly recommended.

References