{"id":"CVE-2026-75157","aliases":["BIT-airflow-2026-75157","EUVD-2026-82766","GHSA-gmw9-258q-r8gm"],"status":"published","title":"Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)","description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00436,"percentile":0.38237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-863"],"published":"2026-09-18T07:51:23Z","modified":"2026-11-04T02:47:51Z","exploits":[{"source":"pocgithub","id":"licitrasimone/cve-2026-75157-poc","title":"licitrasimone/cve-2026-75157-poc","date":"2026-09-19","url":"https://github.com/licitrasimone/cve-2026-75157-poc"}],"fixes":[{"ecosystem":"Bitnami","package":"airflow","fixed_in":["3.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"airflow","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}]}],"products":[{"vendor":"apache software foundation","product":"apache airflow"}],"references":[{"url":"https://github.com/apache/airflow/pull/71736","tags":["patch","web","fix"]},{"url":"https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp","tags":["vendor-advisory","web","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/18/1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75157","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gmw9-258q-r8gm"},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75157.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-75157","title":"Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)","description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","status":"published","published":"2026-09-18T07:51:23.246Z","modified":"2026-11-03T07:00:34.737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-03T08:49:08.781116Z"}],"euvd":[{"id":"EUVD-2026-82766","description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","status":"published","published":"2026-09-18T07:51:23Z","modified":"2026-11-03T07:00:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T08:50:00.381029Z"}],"ghsa":[{"id":"GHSA-gmw9-258q-r8gm","title":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission...","description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","status":"published","published":"2026-09-18T09:31:07Z","modified":"2026-09-18T09:31:10Z","cwes":["CWE-863"],"updated_at":"2026-11-02T15:12:09.483713Z"}],"nvd":[{"id":"CVE-2026-75157","description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","status":"published","published":"2026-09-18T08:17:01.093Z","modified":"2026-11-03T07:20:58.003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-03T11:52:55.230783Z"}],"osv":[{"id":"CVE-2026-75157","title":"Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)","description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","status":"published","published":"2026-09-18T07:51:23.246Z","modified":"2026-11-04T02:47:51.776057736Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-04T02:53:00.786919Z"},{"id":"BIT-airflow-2026-75157","title":"Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)","description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","status":"published","published":"2026-09-25T12:22:24.16Z","modified":"2026-09-25T14:15:15.355571812Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}