PUBLISHED
2026-09-18 08:17
MODIFIED
2026-09-18 08:17
EPSS (Prob. Exploit)
0.44%
Top 63.5%
> DESCRIPTION
Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-863: Incorrect Authorization - The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
AFFECTED PACKAGES:
Unknown / Unknown
8212 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
18/09/2026 08:17
Source: NVD
📊
ENRICHISSEMENT
01/10/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-863: Incorrect Authorization - The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Total des modifications: 1
Dernière mise à jour: 3 weeks ago