CVE-2026-75158: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-75158 is an authorization bypass vulnerability in Apache Airflow's /assets/events REST API that allows any authenticated user with asset-read access to enumerate asset events — including DAG IDs, task IDs, run IDs, and event timestamps — for DAGs they are not authorized to view. The vulnerability affects all versions of Apache Airflow before 3.3.2 and was disclosed on September 21, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Apache Advisory, GitHub Advisory).

The root cause is a missing per-DAG authorization filter (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the GET /api/v2/assets/events endpoint. The endpoint was gated only on a global Assets resource permission check via the FAB auth manager, without applying the ReadableDagsFilterDep that the six sibling queued-events routes in the same file already used. Because the filter was absent from both the row query and the count query, an attacker could use the ?source_dag_id= query parameter to target specific DAGs, and the total_entries field and pagination metadata would still disclose the existence of hidden DAGs even without reading individual rows. The fix introduced PermittedAssetEventFilter applied inside paginated_select, scoping both results and counts to DAGs the caller is authorized to read (GitHub PR #71741, oss-security).

Successful exploitation allows any authenticated user with asset-read access to enumerate sensitive workflow metadata — including source DAG IDs, task IDs, run IDs, event timestamps, and task-authored extra payloads — belonging to DAGs they have no permission to access. In multi-tenant or team-separated deployments using per-DAG access control, this constitutes a confidentiality breach that could expose pipeline structure, operational schedules, and inter-DAG dependencies across organizational boundaries. There is no integrity or availability impact; the vulnerability is limited to information disclosure (Apache Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires authentication (low privileges) but no user interaction, and exploitation is straightforward for any user with asset-read access in a deployment using per-DAG access controls. The EPSS score is approximately 0.23%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The finder is credited as n0mi1k (oss-security).

1. Authenticate: Obtain valid credentials for an Apache Airflow instance running a version before 3.3.2, with at least asset-read access granted to the account.
2. Enumerate all asset events: Send a GET request to the /api/v2/assets/events endpoint — e.g., GET /api/v2/assets/events?limit=100 — and observe that the response includes asset events from all DAGs in the deployment, not just those the caller is authorized to view.
3. Target specific DAGs: Use the ?source_dag_id=<target_dag_id> query parameter to filter events for a specific DAG the caller has no read permission on, confirming cross-tenant data access.
4. Infer hidden DAG existence: Even without reading individual rows, inspect the total_entries field and pagination metadata in the response to determine the number of hidden DAGs and events in the deployment.
5. Harvest metadata: Collect DAG IDs, task IDs, run IDs, event timestamps, and any task-authored extra payload fields from the response to map pipeline structure and operational schedules of unauthorized DAGs (GitHub PR #71741, oss-security).

• Network: Repeated or automated GET requests to /api/v2/assets/events from accounts that do not own or manage the DAGs referenced in source_dag_id parameters; requests with varying source_dag_id values suggesting enumeration.
• Logs: Airflow API access logs showing a single low-privilege user account querying /api/v2/assets/events with multiple different source_dag_id values in a short time window; high-volume pagination requests (e.g., incrementing offset values) against the same endpoint.
• Behavioral: Authenticated API calls to /assets/events from accounts that have no corresponding DAG ownership or operational role, particularly in deployments with strict per-DAG RBAC separation.

The primary remediation is to upgrade Apache Airflow to version 3.3.2 or later, which introduces PermittedAssetEventFilter to scope the /assets/events API and its count queries to only DAGs the caller is authorized to read (Apache Advisory, GitHub PR #71741). For deployments unable to upgrade immediately, restrict the assignment of asset-read permissions to only users who should have visibility into all DAGs in the deployment, effectively limiting the exposure surface. Additionally, review API access logs to identify any unauthorized enumeration attempts against the /assets/events endpoint.

The vulnerability was reported by security researcher n0mi1k and remediated by Apache Airflow maintainer Jarek Potiuk (potiuk), who authored the fix PR and provided detailed commentary on the authorization design decisions, including edge cases around null source_dag_id values and deleted DAGs (GitHub PR #71741). The issue was disclosed via the oss-security mailing list and the Apache security advisory list on September 21, 2026 (oss-security). No significant broader media coverage or social media discussion has been identified beyond standard vulnerability tracking.