CVE-2026-111454

UNKNOWN 0.0

Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

CWE	CWE-200
Vendor	apache software foundation
Product	apache airflow
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow

2.4.0 < 3.0.0

Apache Software Foundation / Apache Airflow

0 < 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/74836 lists.apache.org: https://lists.apache.org/thread.html/9n0sxown9kcjkc6pcx4zvv6gdhbmqvw9 openwall.com: http://www.openwall.com/lists/oss-security/2026/11/09/17

Credits

Zhixi "Jace" Sun, independent security researcher Jarek Potiuk