Apache Airflow 3.3.2: Info Leak in /assets/events API (CVE-2026-75158)
CVE-2026-75158 Published on September 21, 2026
Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events including the source Dag ID, task ID, run ID and event timestamps for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
Vulnerability Analysis
CVE-2026-75158 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-75158 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2026-75158
Want to know whenever a new CVE is published for Apache AirFlow? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Airflow:- Before 3.3.2 is affected.