medium · CVSS v3 6.5

CVE-2026-111454

Apache Airflow’s asset API endpoints expose DAG IDs to users who have asset read permissions, even if they lack permission to view those DAG

Overview

Apache Airflow’s asset API endpoints expose DAG IDs to users who have asset read permissions, even if they lack permission to view those DAGs. This allows authenticated users to discover DAG identifiers they should not see. The flaw is a confidentiality issue that could aid reconnaissance or privilege escalation.

Description

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later.

Impact

Confidentiality is compromised as unauthorized DAG IDs can be enumerated. The vulnerability affects authenticated users with asset read access, potentially enabling them to map workflow structures they are not permitted to view. Integrity and availability are not directly impacted. Defenders should be aware that this could facilitate further attacks if combined with other weaknesses.

Remediation

Upgrade Apache Airflow to version 3.4.0 or later where the asset API enforces proper DAG read checks. In the interim, restrict asset read permissions to only trusted users and monitor API calls for anomalous DAG ID requests. Apply any vendor security patches promptly and review role-based access controls for DAG visibility.

Risk context

The CVSS v3 score is 6.5, indicating a medium severity vulnerability. No EPSS data is available, so the risk is based solely on the severity rating. Defenders should treat this as a moderate risk that warrants timely patching.

Affected products

  • Apache Airflow 2.x
  • Apache Airflow 3.x

Scores

Severity
medium
CVSS v2
4
CVSS v3
6.5
CVSS v4
—
EPSS
—

Apache Airflow Asset API DAG Enumeration Medium Severity Confidentiality Access Control

← All CVEs

Related CVEs

medium

CVE-2026-124505

A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-124571

A flaw has been found in SourceCodester Simple CRUD using PHP and FPDF 1.0. Affected by this vulnerability is an unknown functionality of the file app/register.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-124499

A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-124500

A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis