# CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/597) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-111454-apache-airflow-api-asset-endpoints-return-scheduled-producing-co-c9a81408bf761efe
Kind: security · Impact: low

## In brief

- Apache Airflow asset API endpoints returned IDs of Dags that schedule, produce, or consume an asset without checking the caller's read permission.
- The issue is tracked as CVE-2026-111454 and rated low severity in the disclosure.
- Affected versions are Apache Airflow before 3.4.0.

## Why it matters

Callers of the asset API could learn the IDs of Dags they are not permitted to read, which can reveal pipeline structure in multi-team Airflow deployments.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow 3.4.0

## CVEs

- CVE-2026-111454

## Timeline

- 2026-11-08: Vulnerability disclosed on the oss-security mailing list by Rahul Vats

## Coverage

- [CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read](https://seclists.org/oss-sec/2026/q4/597) — Open Source Security, 2026-11-09

Tags: apache-airflow, security, cve, api, access-control

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev