# CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/596) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-111453-apache-airflow-api-asset-queuedevents-delete-checks-dag-edit-on-bcf2dc87366aa747
Kind: security · Impact: low

## In brief

- The asset queuedEvents DELETE API endpoint checked Dag edit permission against the dag_id query parameter.
- It then deleted queued events for every Dag the caller could read, not only the Dag it was authorized for.
- Affects Apache Airflow 3.3.2 before 3.4.0; Apache rates severity as low.

## Why it matters

Authenticated API users with read access to some Dags could clear queued asset events for Dags they should not be able to modify, which can disrupt scheduling of downstream Dags.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later.
- Review who has API access and which Dag-level permissions they hold until the upgrade is done.

## Versions

- Apache Airflow 3.3.2
- Apache Airflow 3.4.0

## CVEs

- CVE-2026-111453

## Timeline

- 2026-11-08: Vulnerability disclosed on the oss-security mailing list by Rahul Vats

## Coverage

- [CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag](https://seclists.org/oss-sec/2026/q4/596) — Open Source Security, 2026-11-09

Tags: airflow, security, apache, api-authorization, cve-2026-111453, access-control

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev