CVE-2026-75157 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Airflow deployments should assess exposure and prioritize upgrading to apache-airflow 3.3.2 or later. They should also verify if asset-triggered scheduling is in use and adjust RBAC arrangements to restrict Dag edit access properly. Security teams and vulnerability management teams should track exceptions and retest remediated assets.

Why it matters

CVE-2026-75157 allows authenticated users with read-only access to Dags to delete queued asset events in Apache Airflow, potentially disrupting asset-triggered scheduling. Defenders should verify exposure and prioritize upgrading to apache-airflow 3.3.2 or later.

• Authenticated users with read-only access to Dags can delete queued asset events, potentially disrupting asset-triggered scheduling.
• Deployments with asset-triggered scheduling and wide read access to Dags are at risk.
• Verification of exposure and remediation priority is required to prevent potential scheduling disruptions.

Technical summary

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. This allows any authenticated user who can read a Dag to delete that Dag's queued asset events, potentially suppressing asset-triggered scheduling. The vulnerability affects deployments with asset-triggered scheduling and wide read access to Dags. Upgrading to apache-airflow 3.3.2 or later will fix the issue, provided that Dag edit access is properly restricted and asset-triggered scheduling usage is verified.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to apache-airflow 3.3.2 or later.

Recommended defensive actions

• Verify if asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access.
• Upgrade to apache-airflow 3.3.2 or later.
• Review and adjust RBAC arrangements to ensure Dag edit access is properly restricted.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Further verification is required to determine the full scope of affected deployments, including identifying which deployments use asset-triggered scheduling and have wide read access to Dags. Defenders should verify exposure by reviewing current RBAC arrangements and assessing the use of asset-triggered scheduling. Evidence limits suggest that not all deployments may be affected, but explicit verification is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.