CVE-2026-75158

Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

• CWE-200

• https://github.com/apache/airflow/pull/71741Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fyMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/09/21/3Mailing List, Third Party Advisory

Published

Sep 21, 2026

Last Modified

Sep 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75148cgltf through 1.15 contains an integer overflow vulnerabilit…6.1
• CVE-2026-75149marimo before 0.23.15 contains a code injection vulnerabilit…8.8
• CVE-2026-7515The BetterDocs Pro plugin for WordPress is vulnerable to Loc…9.8
• CVE-2026-75151A vulnerability has been found in SourceCodester Onlne Exami…4.3
• CVE-2026-75156Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do …9.1
• CVE-2026-75157Apache Airflow's asset queued-events DELETE endpoints checke…7.5
• CVE-2026-75159An unauthenticated client that can reach a MongoDB Connector…7.5
• CVE-2026-7516A vulnerability was identified in the Lenovo Android Applica…5.1
• CVE-2026-75160An issue in X-Serie Gateway Firmware V6_00_05 allows a remot…9.1
• CVE-2026-75161An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in…8.8
• CVE-2026-75162An information disclosure vulnerability in the opcua-configu…6.5
• CVE-2026-75163An information disclosure vulnerability in the ugw-deviceinf…6.5