Summary
Ein Angreifer kann eine Schwachstelle in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.
Product
Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.
Vulnerabilities 1
-
High 7.5CVE-2026-75157 Public exploit
Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-trigger…
Revision history
-
#1
Initiale Fassung
References
-
Apache Mailing List vom 2026-09-17
https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp
-
OSS Security Mailing List vom 2026-09-17
https://seclists.org/oss-sec/2026/q3/820
-
CVE Record vom 2026-09-17
https://www.cve.org/CVERecord?id=CVE-2026-75157