CVE-2026-75157

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2

Description The asset queued-events DELETE endpoints incorrectly verify the caller's Dag-axis permission using READ instead of EDIT. This allows any authenticated user with read access to a Dag to delete its queued asset events, which silently suppresses asset-triggered scheduling. This issue occurs in deployments where asset-triggered scheduling is active and Dag read access is granted more broadly than edit access, which is the standard Role-Based Access Control (RBAC) configuration.

Recommendations Upgrade to apache-airflow version 3.3.2 or later.