SecurityFan score 21 · Tier C
CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
The Brief
- The asset queuedEvents DELETE API endpoint checked Dag edit permission against the dag_id query parameter.
- It then deleted queued events for every Dag the caller could read, not only the Dag it was authorized for.
- Affects Apache Airflow 3.3.2 before 3.4.0; Apache rates severity as low.
Why it matters
Authenticated API users with read access to some Dags could clear queued asset events for Dags they should not be able to modify, which can disrupt scheduling of downstream Dags.
Who’s affected
- Teams running Apache Airflow 3.3.2 up to 3.4.0
- Operators who grant Airflow API access to users with limited Dag permissions
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
- Review who has API access and which Dag-level permissions they hold until the upgrade is done.
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow 3.3.2 before 3.4.0 Description: Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued…
Timeline
Vulnerability disclosed on the oss-security mailing list by Rahul Vats
Open Source Security
CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag