PT-2026-140279

CVE-2026-111454

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Related identifiers
CVE-2026-111454
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com