---
id: CVE-2026-75157
title: >-
  Apache Airflow's asset queued-events DELETE endpoints checked the caller's
  Dag-axis permission with `READ` instead of `EDIT`
summary: >-
  Apache Airflow's asset queued-events DELETE endpoints checked the caller's
  Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who
  could read a Dag could therefore delete that Dag's queued asset events,
  silently sup…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-863
vendor: Apache Software Foundation
product: apache-airflow
affected:
  - apache-airflow < 3.3.2
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:16:44.553'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75157'
references:
  - url: 'https://github.com/apache/airflow/pull/71736'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/18/1'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00436
epssPercentile: 0.35223
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/licitrasimone/cve-2026-75157-poc'
  checkedAt: '2026-09-25T08:21:12.426Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T18:13:25.295927Z'
ingestedAt: '2026-09-18T08:38:04.104Z'
---

## Overview

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.