{"id":"CVE-2026-75158","aliases":[],"cve":{"records":[{"id":"CVE-2026-75158","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-17T18:58:38.671Z","published":"2026-09-21T14:32:47.818Z","modified":"2026-11-03T07:00:41.233Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-03T07:00:41.233Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-21T15:26:48.122Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-09-21T18:09:31.208Z"}],"references":[{"url":"https://github.com/apache/airflow/pull/71741","tags":["patch"],"source":"apache"},{"url":"https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/21/3","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-21T15:26:44.311869Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter","titleSource":"apache","descriptionSource":"apache","description":"Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.","score":4.3,"severity":"medium","published":"2026-09-21T14:32:47.818Z","modified":"2026-11-03T07:00:41.233Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.0.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-75158"},{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"3.0.0","status":"affected","lessThan":"3.3.2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow-core","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-75158"}],"remediation":[],"references":["https://github.com/apache/airflow/pull/71741","https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy","http://www.openwall.com/lists/oss-security/2026/09/21/3"],"sources":[{"name":"CVE","id":"CVE-2026-75158","modified":"2026-11-03T07:00:41.233Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-75158"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}],"sourceAffected":[],"observedAt":"2026-11-03T07:15:44.971Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:20:33.177Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-03T07:20:34.201Z","attemptedAt":"2026-11-03T07:20:34.201Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-03T07:20:34.177Z","attemptedAt":"2026-11-03T07:20:34.177Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-03T07:20:33.460Z","attemptedAt":"2026-11-03T07:20:33.460Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-03T07:20:33.994Z","attemptedAt":"2026-11-03T07:20:33.994Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-83944","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83944","modified":"Sep 21, 2026, 6:09:31 PM","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-03T07:20:33.460Z"},{"source":"FIRST EPSS","id":"CVE-2026-75158","url":"https://www.first.org/epss/","probability":0.00636,"percentile":0.50501,"date":"2026-11-02","checkedAt":"2026-11-03T07:20:33.994Z"},{"source":"GitHub Advisory Database","id":"GHSA-pfr9-65p3-w9r9","url":"https://github.com/advisories/GHSA-pfr9-65p3-w9r9","modified":"2026-09-21T21:31:51Z","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-03T07:20:34.177Z"},{"source":"NVD","id":"CVE-2026-75158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75158","modified":"2026-09-25T13:58:05.620","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-03T07:20:34.201Z"}],"aiSummary":{"text":"Apache Airflow's `/assets/events` API returns asset events for every Dag without per-Dag authorization filter, allowing authenticated users with asset-read access to enumerate events for Dags they are not authorized to see. Affected versions are before 3.0.0 and from 3.0.0 to before 3.3.2. The weakness exposes sensitive information to unauthorized actors.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T07:16:03.767Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-75158"}]}}