CVE-2026-75158

Executive Summary

CVE-2026-75158 is an authorization-bypass information-disclosure flaw in Apache Airflow's /assets/events API. The endpoint returned asset events for every Dag in the deployment without restricting results to the Dags the caller is authorized to read, so any authenticated user holding asset-read access could enumerate asset events — including source Dag ID, task ID, run ID, and event timestamps — for Dags they are not permitted to see. The flaw is most severe in multi-tenant or team-segmented deployments that rely on per-Dag access control; the NVD description states no special configuration is required beyond the use of that access control model.

Technical Analysis

Apache Airflow is a workflow orchestration platform in which users define Dags (directed acyclic graphs) representing pipelines, and tasks within them. Airflow supports fine-grained, per-Dag authorization so that teams or tenants sharing one deployment can only read the Dags assigned to them. Airflow also exposes an asset (dataset) subsystem: asset events record metadata about asset-producing or asset-consuming activity, including the source Dag ID, task ID, run ID, and event timestamps, as enumerated in the NVD description.

The /assets/events API is the interface through which a caller lists asset events. According to the NVD description, the vulnerability is a missing authorization filter rather than a parsing, injection, or memory-safety defect. The endpoint's query returned asset events for every Dag in the deployment and did not constrain results to the set of Dags the caller is authorized to read. Consequently, an authenticated user with asset-read access received cross-tenant event records.

Two distinct disclosure paths are described, both rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor):

1. Row-level disclosure. Individual asset event records returned by /assets/events carried the source Dag ID, task ID, run ID, and event timestamps of Dags outside the caller's authorization scope. These fields enable reconstruction of pipeline topology, scheduling behavior, and execution history for hidden Dags.

2. Metadata/side-channel disclosure. The NVD description notes that the same filtering was absent from the count query backing the listing. As a result, total_entries and pagination metadata disclosed the existence of hidden Dags even when the caller did not inspect the individual event rows. An attacker could therefore determine the presence and approximate volume of otherwise-invisible Dags purely from the collection's size and page boundaries.

The attack surface is the REST API layer reachable over the network, as reflected by the CVSS vector AV:N. The flaw requires authentication and a low-privilege role — per the NVD description, "any authenticated user holding asset-read access" — mapping to PR:L. No user interaction is required (UI:N). The scope is unchanged (S:U): the exploit stays within the authorization model of the same Airflow deployment. Confidentiality impact is rated Low (C:L), while integrity (I:N) and availability (A:N) impacts are absent, yielding the published score of 4.3.

Because the disclosure is a read-only authorization gap in a query, there is no code execution, privilege escalation, or data modification involved. The exposure is limited to the fields the endpoint legitimately serves — but served to the wrong audience. The count-query omission is notable because even deployments that restrict direct row inspection may still leak Dag existence through pagination totals, meaning fixing row filtering alone would not fully close the issue. Upgrading to apache-airflow 3.3.2 or later is the vendor-stated remediation.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code was identified for CVE-2026-75158. The attack chain below is inferred from the vulnerability class (broken object-level / per-Dag authorization in a read API) and from the facts stated in the NVD description. No specific function names, route parameters, or code paths beyond those in the description are asserted.

1) Reconnaissance and target identification. The attacker identifies an Airflow deployment exposing the REST API (network-reachable, AV:N). Enumeration typically begins with establishing that the /assets/events endpoint is served and that the API version in use predates 3.3.2. Shodan-style product fingerprinting and HTTP title/body matching for Airflow instances can locate candidate targets; the attacker's primary interest is deployments where multiple teams or tenants share one instance under per-Dag access control. The attacker registers or is issued a normal account and confirms it holds at least asset-read access. This is the minimum role the NVD description identifies as sufficient.

2) Triggering the flaw class. The attacker issues authenticated read requests to /assets/events. Because the server-side query lacks a per-Dag authorization filter — the core defect — the response is not scoped to the caller's authorized Dags. Unlike a classic IDOR, the attacker does not need to guess or iterate object identifiers to reach foreign objects; the unfiltered list returns them directly. The attacker simply lists, and the collection itself is over-scoped.

3) Data extraction at the vulnerability-class level. The attacker reads the returned records, which per the NVD description contain the source Dag ID, task ID, run ID, and event timestamps. Beyond rows, the attacker observes the collection's total_entries value and pagination behavior: since the count query was also unfiltered, the totals reflect all Dags, not the caller's subset. The attacker can step through pages to harvest the full event set and can use the total count as an existence oracle, confirming hidden Dags even without reading individual events. No exploitation payload is required — the attack is performed through legitimate, well-formed authenticated GET-style read operations against the endpoint.

4) Post-exploitation impact. The harvested metadata enables an attacker with a low-privilege account to map parts of the environment they were not authorized to see: which Dags exist, their identifiers, their task structure, their run history, and their timing. This information supports lateral reconnaissance, targeting, and social engineering within the organization. It does not by itself grant write access, code execution, or the ability to alter pipelines; the impact remains information disclosure rated C:L, I:N, A:N. In segmented or regulated environments, the cross-tenant leak of pipeline identifiers and scheduling data can nonetheless be material for compliance and for follow-on campaigns.

Impact Assessment

The direct impact is unauthorized disclosure of asset-event metadata across Dag authorization boundaries. For any deployment using per-Dag access control to separate teams or tenants, an authenticated low-privileged user with asset-read access can enumerate the source Dag ID, task ID, run ID, and timestamps of Dags they are not permitted to read. The count-query omission additionally reveals the existence and volume of hidden Dags through total_entries and pagination, which is a confidentiality leak in its own right.

Business consequences center on multi-tenant isolation failures: pipeline topology and execution history can expose business logic, scheduling cadence, third-party integrations, data-source identifiers, and intra-organization structure. In environments where Dag names or IDs embed sensitive project, client, or system identifiers, the metadata itself can be sensitive. Because the vector is AV:N/PR:L/UI:N with C:L/I:N/A:N and an overall score of 4.3, the blast radius is bounded — no integrity or availability loss, and confidentiality impact is limited to the fields the endpoint serves — but the population at risk is every authenticated user with asset-read access on an affected, segmented deployment. CVSS scope is unchanged (S:U), so the effect is contained within the Airflow deployment's own authorization model rather than crossing into other security authorities.

This CVE is not listed in CISA KEV and has no public exploit or PoC, so exploitation to date is best characterized as unobserved in open sources. The elevated risk is contextual, not intrinsic: organizations that share a single Airflow instance across teams, customers, or regulatory boundaries face the greatest exposure.

Detection Guidance

Sigma Rule

title: Potential Apache Airflow /assets/events Dag Authorization Bypass Enumeration
id: 7c1f9d2a-3b64-4e58-9f7a-airflowcve75158
status: experimental
description: Detects authenticated accesses to the Airflow /assets/events API consistent with cross-Dag asset event enumeration (CVE-2026-75158). Correlates endpoint access with anomalous pagination or high total_entries retrieval by low-privilege users.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75158
author: valtersit.com
date: 2026/01/01
logsource:
  product: apache_airflow
  service: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/assets/events'
  selection_method:
    cs-method: 'GET'
  selection_status:
    sc-status: 200
  condition: selection_endpoint and selection_method and selection_status
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate asset dashboards and authorized users listing their own Dags
  - Automated monitoring that polls /assets/events on a fixed schedule
level: medium
tags:
  - attack.t1213
  - cve.2026.75158

YARA Rule

rule CVE_2026_75158_Airflow_Assets_Events_Scoped_Access
{
    meta:
        description = "Detects references to the Airflow /assets/events API path in web logs, request captures, or application source that may be associated with CVE-2026-75158 enumeration activity"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75158"
        cve = "CVE-2026-75158"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $uri_raw  = "/assets/events" ascii wide nocase
        $uri_enc  = "%2Fassets%2Fevents" ascii wide nocase
        $field1   = "total_entries" ascii wide nocase
        $field2   = "asset_events" ascii wide nocase
        $dag      = "dag_id" ascii wide nocase
        $ti       = "task_id" ascii wide nocase
        $ri       = "run_id" ascii wide nocase

    condition:
        uint32(0) != 0xfeedface and
        (
            $uri_raw or $uri_enc
        ) and
        2 of ($field*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75158 Apache Airflow /assets/events Dag Authorization Bypass Enumeration"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/assets/events"; http.uri; content:"limit="; http.uri; content:"offset="; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-recon; reference:cve,2026-75158; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75158; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202675158; rev:1;)

Note: the rule keys on the /assets/events endpoint combined with pagination parameters (limit/offset) and rate-throttles repeated hits to separate systematic enumeration from normal dashboard traffic.

Elastic Detection

sequence by user.name with maxspan=5m
  [ http where url.path == "/assets/events" and http.request.method == "GET" and http.response.status_code == 200 ]
  [ http where url.path == "/assets/events" and http.request.method == "GET" and http.response.status_code == 200 and url.query : ("offset=*" or "limit=*") ]

This flags a caller repeatedly hitting /assets/events with pagination parameters — a pattern consistent with sweeping the unfiltered event collection. Low-privilege service accounts that only ever read a small fixed set of Dags will still trip the second event, so tune by user role if the deployment's legitimate users legitimately paginate.

Splunk SPL Query

index=airflow sourcetype=airflow:webserver OR sourcetype=airflow:api
uri_path="/assets/events" http_method=GET status=200
| eval user=coalesce(user, remote_user, cs_username, "-")
| bin _time span=1m
| stats count AS hits dc(uri_query) AS distinct_queries values(uri_query) AS queries BY user, _time
| where hits >= 20 OR distinct_queries >= 4
| sort - hits

This aggregates authenticated GET requests to /assets/events per user per minute and surfaces users generating unusually high request or distinct-pagination counts, indicating broad enumeration rather than reading a narrow authorized subset.

Wazuh OSSEC Rule

<group name="apache_airflow,web,accesslog,">
  <rule id="2026751" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <url>/assets/events</url>
    <description>Airflow /assets/events API access (baseline)</description>
  </rule>

  <rule id="2026752" level="6" frequency="20" timeframe="60">
    <if_matched_sid>2026751</if_matched_sid>
    <same_source_ip />
    <description>Possible CVE-2026-75158: repeated Airflow /assets/events access indicating cross-Dag asset event enumeration</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_75158,recon,</group>
  </rule>

  <rule id="2026753" level="8">
    <if_sid>2026751</if_sid>
    <regex>limit=|offset=</regex>
    <description>Possible CVE-2026-75158: Airflow /assets/events pagination sweep by authenticated user</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_75158,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit, or backport reference was located in the tracked sources; the only remediation statement available is the NVD description's guidance to upgrade to apache-airflow 3.3.2 or later.

1) Immediate mitigations

• Restrict network exposure of the Airflow REST API to trusted management networks, VPN, or an authenticated API gateway; do not expose /assets/events or the API broadly to the internet.
• Audit and minimize asset-read permissions. Because the flaw requires only asset-read access, reducing the number of roles granted that permission shrinks the population able to abuse the gap.
• In segmented deployments, review whether per-Dag isolation is the intended tenancy boundary; temporarily avoid placing multiple tenants on a single Airflow instance if the metadata leak is unacceptable until patched.
• Increase monitoring on the /assets/events endpoint per the detection guidance above, focusing on low-privilege users paginating through large result sets.

2) Patch / upgrade steps

• Upgrade to apache-airflow 3.3.2 or later as directed by the NVD description.
• Verify the deployed version after upgrade and confirm the /assets/events listing and its count query are scoped to the caller's authorized Dags.
• Where an upgrade cannot be performed immediately, track the upstream project for a security advisory, commit, or backport; none was available at the time of writing (patch confidence 0/4).

3) Long-term hardening

• Enforce least privilege on all read roles, and review asset-read grants as part of routine access recertification.
• Add regression testing and code review gates for per-object and per-Dag authorization on list and count queries, treating count/metadata responses as subject to the same authorization as row data.
• Centralize centralized API logging with per-user attribution so enumeration patterns are visible and alertable.
• Maintain an inventory of multi-tenant Airflow deployments and prioritize them for upgrade windows and monitoring coverage.

References

• NVD — CVE-2026-75158: https://nvd.nist.gov/vuln/detail/CVE-2026-75158
• Apache Airflow project (vendor) — https://airflow.apache.org/ (consult security advisories for the 3.3.2 release)
• Apache Software Foundation security page — https://www.apache.org/security/
• MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html

Threat actor campaigns / exploit-in-the-wild: none identified. CVE-2026-75158 is not listed in CISA KEV, and no public proof-of-concept, Nuclei template, or exploit code was observed in the tracked sources. EPSS has not yet scored this CVE by FIRST.org.