CVE-2026-75157 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Airflow deployments using asset-triggered scheduling should assess exposure and prioritize upgrading to apache-airflow 3.3.2 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or monitor Apache Airflow deployments. They should review current configurations, verify exposure, and implement necessary remediation steps.

Why it matters

CVE-2026-75157 affects Apache Airflow deployments with asset-triggered scheduling and improper Dag axis permissions, allowing unauthorized deletion of queued asset events. Defenders should verify exposure and upgrade to apache-airflow 3.3.2 or later.

• Potential disruption of asset-triggered scheduling due to improper permission checks.
• Increased risk of unauthorized changes to Dag's queued asset events.
• Need for verification of current exposure and remediation priority.

Technical summary

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. This allows any authenticated user who can read a Dag to delete that Dag's queued asset events, potentially disrupting asset-triggered scheduling. The vulnerability affects deployments using asset-triggered scheduling with improper Dag axis permissions. Defenders should verify exposure and upgrade to apache-airflow 3.3.2 or later to mitigate the issue. The issue is a result of incorrect permission checks in the DELETE endpoints.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to apache-airflow 3.3.2 or later.

Recommended defensive actions

• Verify if your Apache Airflow deployment uses asset-triggered scheduling and Dag read access is granted more widely than Dag edit access.
• Upgrade to apache-airflow 3.3.2 or later.
• Review and adjust Dag axis permissions to ensure proper access control.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from Apache and NVD indicates that CVE-2026-75157 affects Apache Airflow deployments using asset-triggered scheduling with Dag read access granted more widely than Dag edit access. The CVE record was published on 2026-09-18T08:17:01.093Z and has not been modified since then. There is no indication of in-the-wild exploitation. Defenders should verify exposure and review current configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.