EUVD-2026-82766
GHSA-gmw9-258q-r8gm
Severity by source
Network API reachable, low complexity; requires an authenticated user with Dag READ so PR:L; integrity-only (I:L) as scheduling state is altered, no confidentiality or availability impact.
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Authenticated Apache Airflow users who hold only Dag READ permission can delete a Dag's queued asset events via the asset queued-events DELETE endpoints, silently suppressing asset-triggered scheduling for Dags they were never authorized to modify. The endpoints check the callers Dag-axis permission with READ instead of EDIT, and the advisory notes this is reachable in any deployment that uses asset-triggered scheduling under the normal RBAC arrangement where Dag read access is granted more widely than Dag edit access, with no special configuration required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only when asset-triggered scheduling is actively in use AND Dag read access is granted more widely than Dag edit access - which the advisory notes is the normal RBAC arrangement, so no non-default configuration is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue, and the available signals are consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to apache-airflow 3.3.2 or later, which corrects the permission check so the asset queued-events DELETE endpoints require Dag EDIT rather than Dag READ; the fix is the upstream pull request at https://github.com/apache/airflow/pull/71736 and general release information is at https://airflow.apache.org/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Apache Airflow instance, confirm which ones run asset-triggered scheduling, and identify which users and service accounts currently hold Dag READ on those Dags; where possible, temporarily remove asset queued-events DELETE access and review Airflow audit logs for unexpected calls to the asset queued-events DELETE endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today