CVE-2026-111453

MEDIUM 4.3

Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.

CWE	CWE-863
Vendor	apache software foundation
Product	apache airflow
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow

Be the first to know when new medium vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow

3.3.2 < 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/74839 cve.org: https://www.cve.org/CVERecord?id=CVE-2026-75157 lists.apache.org: https://lists.apache.org/thread.html/z212137tkfobdgl0hnos7qg6w6r1mxw5

Credits

hataehoon Jarek Potiuk