{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow-core","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.3.2","status":"affected","version":"3.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-75157","cwes":["CWE-863"],"description":"Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","epss":{"date":"2026-11-02","percentile":0.37922,"score":0.00436},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1793689234737,"publishedAt":1789717883246,"references":[{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/71736"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/09/18/1"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/71736"}],"revision":"89f8235e0cce083ad85290f2f1e930ef11f342e56345ab16b5860ef0dfd53148","sources":[{"modifiedAt":1793689234737,"name":"CNA: apache","retrievedAt":1793693360834,"url":"https://www.cve.org/CVERecord?id=CVE-2026-75157"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793693364997,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75157"}],"ssvc":{"assessedAt":1790100805295,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)","updatedAt":1793693364997}