CyberRota Analysis
AI-GeneratedApache Airflow's `/assets/events` API is vulnerable, allowing authenticated users with asset-read access to enumerate asset events for all Dags, including those they are unauthorized to view. This exposure can lead to information disclosure regarding hidden Dags, task IDs, and event timestamps, potentially compromising data privacy in multi-tenant environments. Organizations utilizing per-Dag access control should prioritize upgrading to version 3.3.2 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
Related CVEs
Other vulnerabilities affecting the same vendor(s)