CVE-2026-111453
Summary
by MITRE • 11/09/2026
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
Xxx Xxxxxxxxxxxxx Xx Xxxxxx Xxxxxxx Xxxxxxxxxx X Xxxxxxxx Xxxxxxxxxxxxx Xxxxxx Xxxxxx Xxx Xxxxx Xxxxxxxxxx Xxxxxxxxx, Xxxxxxxxxxxx Xxxxxxxxx Xxx Xxx Xxxxxxxx Xxxxxxxxxxx Xxx Xxxxxxxx Xxxxxx Xxxxxx Xxxxxxxxxx Xxxx Xxxxxx. Xxxx Xxxx Xxxxx Xxxx Xx Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxx Xxxxxxx Xxxxxx Xxxxxx Xxxxxxxx Xxxxxxxxxxx Xxxxxxxx. Xxxxx Xxxxxxx Xxxxxxxx Xxxxxxxxx Xx Xxxxxxxx Xxxxxxx Xxxxxx Xx Xxxxxxxxxx Xxxxxxxxxxx Xxxxxxx Xxxxxxxx Xxxxxxxxxxx, Xxxx Xxxxxxxxxx Xxxxxxxx Xxxxxx Xx Xxxxxxx Xxxxxx Xxxxxxx Xxxxx Xxxx Xxxxxxxxxx Xxxxxxxx Xxxxxxxx. Xxx Xxxx Xxxxxxxxx Xxxxxxxxxx Xxxx Xx Xxx Xxxxx Xxxx Xx Xxxxxxxxx Xxxxx Xxxxxx Xxxxxx Xxxxxx Xx Xxxxxxx Xxxx Xxxxxxx. Xxxxxxx Xx Xxxxxxxxxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xx Xxxxxx Xxxxxx Xx Xxxx Xxxxx Xxx Xxxxxxxxxxxxx Xxxx Xxxxx Xxxxxxxx Xxxx Xxxxxxxxxx, Xxx Xxxxxx Xxxxxxxxxxx Xxxxxxxxx Xxxxxxxxxxx Xxxxx Xxxxxx Xx Xxxx Xxxxxx Xx X Xxxxxxx Xxxxx Xxxx Xxxxxxx Xxxxxxxxxxx Xxxx Xxx Xxx Xxxxxxx Xx Xxx Xxxx.
Xxxx Xx Xxxxxxxxxxx Xxxxxxxxxxx, Xxxx Xxxxxxxxxxxxx Xxxx Xxxxxx Xxxxxxxxx Xxxxxx Xx Xxxxxxxxxxx Xxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxxxxxxx Xx Xxxxxxxxxxx Xxxx. Xx Xxxxxxxx Xxx Xxxxxxxxx Xxxx Xxxxxxxxxx Xxx Xx Xxxxx Xxx Xxx Xxx Xxxxxxx Xxxx Xxxxxx Xx Xxxxx Xxxx Xxx Xxxxxxx Xxxx Xxxxxxxx Xx Xxxxxxxx Xxxxx-xxxxxxxxx Xxxx Xx Xxxxx Xxxxxxxxx Xxxx. Xx Xxxxxxxx Xxx Xxxxxx Xxxxxx Xxxx Xxxxx Xx Xxxxxxxx Xxx Xxxxxxxxxx Xxxxx, Xxx Xxxxxxxx Xxxxxxxxxxx Xxxxxxxx Xxxxx Xxxxxxxxx Xxxx Xxxxxxxxx Xxxxxxx Xxxxxxxxxxx Xxxxxx Xxxxxx Xxxxx Xx Xxxxxx Xxxxxxxxxxx Xx Xxx Xxxxxx Xxxx Xxxxxxxxxx. Xxxx Xxxxxxxxxx Xxxxxxxxxx Xxx Xxxxxxxxx Xxx Xxxxxxxxxxx Xx Xxxx Xxxxxxxxx, Xxxxxxxxxxx Xxxxxxx Xx Xxxxxx Xxxxxxxx-xxxxxxxx Xxxx, Xxxxxxx Xxxxxxxxx Xxxxxx, Xx Xxxxxx Xxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxxxxxxx Xxxxxx Xxxxx Xxxxx-xxxxx Xxxxxxxxxx Xx X Xxxxxxx Xxxxxxxxx Xxx Xxxxxxxx Xxxxxxxxxx.
Xxxx Xxxxx Xx Xxxxxxxxxxx Xxxxx Xxx-xxx, Xxxxx Xxxxxxx Xxxxxxxx Xxxxxxx Xx Xxxxxxxxxxx Xxxx Xxxxxxxx Xxxxxxxx, Xx Xxx Xxxxxx Xxxxx Xx Xxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxx Xx Xxxxxxxx Xxxxxx Xxxxxxxxxx. Xxxxxxxxxxx, Xx Xxxxxx Xxxx Xxxxx Xxx&xx Xxxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxx Xxx Xxxxxxx Xxxxxxx, Xxxxxxxxxxxx Xxxxx Xx Xxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxx Xxxxxxx Xxxxxxx Xxxxx Xxxxxxxx Xxxxx. Xxx Xxxxxxxxxxxxx Xxxxxxxxxx X Xxxxxx Xxxxxxx Xx Xxx Xxxxxx Xxxxx Xxxxxxxxxx Xxxxxx Xxx Xxxxxxx Xxx Xxxxxxx Xx Xxxxxxx Xxx Xxxxx Xxxxxxxxx, Xxxxxxx Xx Xxxxxxxxxx Xxxx Xxxxxxx Xx Xxxxxxxxx Xxxx Xxxxxx Xxxxxx Xxxxxxxxx Xx Xxxxxxxx Xxxxxx Xxxxxxxx.
Xx Xxxxxxxx Xxxx Xxxx, Xxxxxxxxxxxxx Xxxxxxx Xxxxxx Xxxxxxx Xxxx Xxxxxxx Xxxxxxxxxxx Xx Xxxxxxx X.x.x Xx Xxxxx. Xxxx Xxxxxxx Xxxxxxxx Xxx Xxxxxxxxx Xxxxxxxxxxxxx Xxxxx Xxxx Xxxxxxxx Xxxxxx Xxxxxxxx Xxxxxxxxxx Xx Xxxx Xxxxx Xxxxxx Xxx Xxxx Xxxxx Xxx Xxxx Xxx Xxxxxxxx Xxxx Xxxxxxxxxxx. Xxxxx Xx Xxxxxxx Xx Xxxxxxxxx, Xxxxxxxxxxxxxx Xxxxxx Xxxxxxxx Xxxxxxxxxxxx Xxxxxxx-xxxxx Xxxxxx Xxxxxxxx Xx Xxx Xxxxx Xx Xxxxxxxx Xxxxxxxx Xx Xxxx Xxxxxxxx Xxx Xxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxxxxxx Xx Xxxxxxxx. Xxxxxxxxxxxx, Xxxxxxxx Xxxx Xxx Xxxxxxx Xxxxxxxx Xx Xxxxx Xxxxx Xxxxxxxxx Xxx Xxxx Xxxxxxxx Xxxxxxxxx Xxxxxxxxxxxx Xxxxxxxx Xx Xxxxxxxxxx Xxx Xxxx Xxxxxxxx Xxxxxxxxxx Xxxxxxxxxxx Xxxx Xxxxxxxx Xxxx Xxxxxxx Xxx Xxxx Xxxxxxxxxx Xxx Xxxxx Xxxx Xxxxxx.