Vulnerability · low
Apache Airflow queuedEvents delete ignores readable Dag check (CVE-2026-111453)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Airflow API users with limited Dag-level permissions on affected 3.3.x deployments
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
- Review who has API access and which Dag-level permissions they hold until the upgrade is done.
The Brief
- The asset queuedEvents DELETE API endpoint checked Dag edit permission against the dag_id query parameter.
- It then deleted queued events for every Dag the caller could read, not only the Dag it was authorized for.
- Affects Apache Airflow 3.3.2 before 3.4.0; Apache rates severity as low.
Why it matters
Authenticated API users with read access to some Dags could clear queued asset events for Dags they should not be able to modify, which can disrupt scheduling of downstream Dags.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Airflow is a developer and data-ops orchestration tool that teams build with and run. |
| No | Core infrastructure | Judgment: a single workflow framework, not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: Apache Airflow is a widely used mainstream data orchestration platform. |
| No | Exploited in the wild | Open Source Security: describes a permission-check flaw; no observed attacks reported. |
| No | Public exploit | Open Source Security: advisory describes the flaw; no exploit code or proof-of-concept mentioned. |
| No | Remote, no login | Open Source Security: exploiting it requires Dag edit permission, so credentials are needed. |
| No | Full takeover | Open Source Security: authorization bypass deleting queued events; no code execution or admin takeover described. |
| No | Secrets exposed | Open Source Security: flaw deletes queued event rows; no credentials or data exposure described. |
| No | Supply chain | Open Source Security: a normal authorization bug in legitimate code; no malicious code shipped. |
| No | No fix yet | Open Source Security: affected versions are 3.3.2 before 3.4.0, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on the oss-security mailing list by Rahul Vats
Open Source Security
CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
Source
CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided