Dashboard / CVE-2026-111453

CVE-2026-111453

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 59/100
Published: 2026-11-09 Modified: 2026-11-10 First seen: 2026-11-09 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: Low
A: None

Description

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Apache Software Foundation Apache Airflow 3.3.2 < 3.4.0
Apache Software Foundation Apache Airflow 3.3.2 < 3.4.0

References & Advisories (3)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

0.26%
Raw Score 0.002640
Percentile 18.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00264
2026-11-12
0.00264
2026-11-10
0.00264

Intelligence Sources

mitre ref →
nvd ref →

External Links