https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 13:09:37 +0000 https://db.gcve.eu/vuln/bit-airflow-2026-75157 <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Apache Airflow&#39;s asset queued-events DELETE endpoints checked the caller&#39;s Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag&#39;s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.</p> <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Apache Airflow&#39;s asset queued-events DELETE endpoints checked the caller&#39;s Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag&#39;s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.</p> https://db.gcve.eu/vuln/bit-airflow-2026-75157 https://db.gcve.eu/vuln/fkie_cve-2026-75157 <p>Apache Airflow&#39;s asset queued-events DELETE endpoints checked the caller&#39;s Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag&#39;s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.</p> <p>Apache Airflow&#39;s asset queued-events DELETE endpoints checked the caller&#39;s Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag&#39;s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.</p> https://db.gcve.eu/vuln/fkie_cve-2026-75157 https://db.gcve.eu/vuln/ghsa-gmw9-258q-r8gm <p>Apache Airflow&#39;s asset queued-events DELETE endpoints checked the caller&#39;s Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag&#39;s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.</p> <p>Apache Airflow&#39;s asset queued-events DELETE endpoints checked the caller&#39;s Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag&#39;s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.</p> https://db.gcve.eu/vuln/ghsa-gmw9-258q-r8gm