---
id: "CVE-2026-111453"
page: "https://infrastack.ai/live/CVE-2026-111453"
kind: "vulnerability"
aliases: ["CVE-2026-111453"]
title: "Apache Airflow: asset queued-event deletion ignores Dag edit permission, suppressing other Dags' runs"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-airflow", "python", "runtime", "self-hosted"]
not_affected_if: ["auth-disabled-not-exposed", "single-tenant-trusted-users"]
published_at: "2026-11-09T10:17:04+00:00"
first_seen_at: "2026-11-09T10:25:48+00:00"
updated_at: "2026-11-09T10:26:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111453", "first_seen_at": "2026-11-09T10:25:48+00:00"}]
exploit_sources: []
---

# Apache Airflow: asset queued-event deletion ignores Dag edit permission, suppressing other Dags' runs

Link for people: https://infrastack.ai/live/CVE-2026-111453 (this .md is for agents)

An authenticated Airflow user with edit rights on one Dag can delete queued asset events for Dags they can only read. This suppresses asset-triggered runs of Dags they cannot edit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `airflow version` or `pip show apache-airflow`, and compare it to the fixed version below.
- Look for Airflow API use of the asset queued-events delete endpoint by users who hold only Dag edit permission.

## Fix

- apache-airflow `3.4.0` or later (3.3.2 is not enough; it fixed CVE-2026-75157 only)

## Timeline

- 2026-11-09T10:25:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111453

## From the sources

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_