CVE-2026-111453 · Runtime
NO FIX YET · SEE WHAT TO DO
An authenticated Airflow user with edit rights on one Dag can delete queued asset events for Dags they can only read. This suppresses asset-triggered runs of Dags they cannot edit.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments of Apache Airflow where some users have Dag edit permission on at least one Dag and read access to others. Users who upgraded to 3.3.2 for CVE-2026-75157 are still affected. unknown whether single-user or fully-trusted deployments are exposed beyond this.
Not affected if auth-disabled-not-exposed, single-tenant-trusted-users
Who cares apache-airflow, python, self-hosted
airflow version or pip show apache-airflow, and compare it to the fixed version below.3.4.0 or later (3.3.2 is not enough; it fixed CVE-2026-75157 only)Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the dag_id query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.