{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75158", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-17T18:58:38.671Z", "datePublished": "2026-09-21T14:32:47.818Z", "dateUpdated": "2026-09-21T15:26:48.122Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-21T14:32:47.818Z"}, "title": "Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter", "problemTypes": [{"descriptions": [{"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "cweId": "CWE-200", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "packageURL": "pkg:pypi/apache-airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.2", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow"}], "descriptions": [{"value": "Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events \u2014 including the source Dag ID, task ID, run ID and event timestamps \u2014 for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events \u2014 including the source Dag ID, task ID, run ID and event timestamps \u2014 for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later."}]}], "references": [{"url": "https://github.com/apache/airflow/pull/71741", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "n0mi1k", "type": "finder"}, {"lang": "en", "value": "Jarek Potiuk", "type": "remediation developer"}], "x_generator": {"engine": "airflow-s/generate_cve_json.py"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-21T15:26:44.311869Z", "id": "CVE-2026-75158", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T15:26:48.122Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow", "packageURL": "pkg:pypi/apache-airflow", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events \u2014 including the source Dag ID, task ID, run ID and event timestamps \u2014 for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later."}], "id": "CVE-2026-75158", "lastModified": "2026-09-21T15:17:31.360", "metrics": {}, "published": "2026-09-21T15:17:31.360", "references": [{"source": "security@apache.org", "url": "https://github.com/apache/airflow/pull/71741"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{}