CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

The Brief

Apache Airflow asset API endpoints returned IDs of Dags that schedule, produce, or consume an asset without checking the caller's read permission.
The issue is tracked as CVE-2026-111454 and rated low severity in the disclosure.
Affected versions are Apache Airflow before 3.4.0.

Why it matters

Callers of the asset API could learn the IDs of Dags they are not permitted to read, which can reveal pipeline structure in multi-team Airflow deployments.

Who’s affected

Apache Airflow users running versions before 3.4.0
Teams exposing the Airflow asset API to users with limited Dag access

What to do

Upgrade Apache Airflow to 3.4.0 or later

Apache Airflow 3.4.0
CVE-2026-111454
#apache-airflow
#security
#cve
#api
#access-control

Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those…

Read the full story at seclists.org ↗

Timeline

Nov 8
Vulnerability disclosed on the oss-security mailing list by Rahul Vats
Nov 9 · 7:28 AM
Open Source Security
CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read