Which versions of Apache Airflow are affected by EUVD-2026-82766?

Apache Airflow deployments that use asset-triggered scheduling are exposed to a permission-check flaw that allows any authenticated user holding only Dag READ rights to delete a Dag's queued asset…. A patch is available.

How to fix or mitigate EUVD-2026-82766?

Within 24 hours, inventory every Apache Airflow instance, confirm which ones run asset-triggered scheduling, and identify which users and service accounts currently hold Dag READ on those Dags; where possible, temporarily remove asset queued-events DELETE access and review Airflow audit logs for unexpected calls to the asset queued-events DELETE endpoints. Within 7 days, upgrade all affected deployments to Apache Airflow 3.3.2, the vendor-released fix version, and reconcile the structured patch flag (which reported no patch available) against the vendor advisory so no instance is left unpatched on the basis of conflicting data; re-run the RBAC review after upgrading to confirm the DELETE endpoints now enforce Dag EDIT rather than READ. Within 30 days, redesign the RBAC baseline so Dag READ is no longer broadly granted wherever asset-triggered scheduling is enabled, add alerting on queued asset event deletions and on missed asset-triggered Dag runs, and re-validate that no over-privileged accounts retain Dag READ on sensitive Dags.

Apache Airflow EUVD-2026-82766

| CVE-2026-75157 CRITICAL

Incorrect Authorization (CWE-863)

2026-09-18

GHSA-gmw9-258q-r8gm

Authentication Bypass Apache

Severity by source

vuln.today AI

4.3 MEDIUM

Network API reachable, low complexity; requires an authenticated user with Dag READ so PR:L; integrity-only (I:L) as scheduling state is altered, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Lifecycle Timeline

Patch available

Sep 18, 2026 - 09:16 EUVD

Analysis Generated

Sep 18, 2026 - 06:16 vuln.today

CVE Published

Sep 18, 2026 - 04:58 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Authorization Bypass in Apache Airflow - CVE-2026-75157 Sep 18, 2026

AnalysisAI

Authenticated Apache Airflow users who hold only Dag READ permission can delete a Dag's queued asset events via the asset queued-events DELETE endpoints, silently suppressing asset-triggered scheduling for Dags they were never authorized to modify. The endpoints check the callers Dag-axis permission with READ instead of EDIT, and the advisory notes this is reachable in any deployment that uses asset-triggered scheduling under the normal RBAC arrangement where Dag read access is granted more widely than Dag edit access, with no special configuration required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitable only when asset-triggered scheduling is actively in use AND Dag read access is granted more widely than Dag edit access - which the advisory notes is the normal RBAC arrangement, so no non-default configuration is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuinely low-priority issue, and the available signals are consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to apache-airflow 3.3.2 or later, which corrects the permission check so the asset queued-events DELETE endpoints require Dag EDIT rather than Dag READ; the fix is the upstream pull request at https://github.com/apache/airflow/pull/71736 and general release information is at https://airflow.apache.org/. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every Apache Airflow instance, confirm which ones run asset-triggered scheduling, and identify which users and service accounts currently hold Dag READ on those Dags; where possible, temporarily remove asset queued-events DELETE access and review Airflow audit logs for unexpected calls to the asset queued-events DELETE endpoints. …

Threat intelligence, references, and detailed analysis are available after sign-in.