← Back to search

CVE-2026-75158

4.3 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary
The flaw allows any authenticated user with asset-read access to enumerate asset events for all Dags in the deployment, including those they are not authorized to see, due to missing access control filters.
Exploitability
Exploitation is relatively easy as long as an attacker has basic authentication and asset-read permissions. Precondition is the presence of per-Dag access control.
Blast radius
If exploited, it could reveal sensitive information about Dags not accessible to the user, potentially leading to unauthorized access or data exposure.
Prioritized remediation
Upgrade Apache Airflow to version 3.3.2 or later to apply necessary access control filters.
auth-bypassapi-exploitinfo-leakweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-200

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.