{"api_version":"1","generated_at":"2026-11-10T07:51:30+00:00","cve":"CVE-2026-111454","urls":{"html":"https://cve.report/CVE-2026-111454","api":"https://cve.report/api/cve/CVE-2026-111454.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-111454","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111454"},"summary":{"title":"Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read","description":"Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-09 10:17:04","updated_at":"2026-11-09 13:17:04"},"problem_types":["CWE-200","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/17","name":"http://www.openwall.com/lists/oss-security/2026/11/09/17","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/apache/airflow/pull/74836","name":"https://github.com/apache/airflow/pull/74836","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.apache.org/thread.html/9n0sxown9kcjkc6pcx4zvv6gdhbmqvw9","name":"https://lists.apache.org/thread.html/9n0sxown9kcjkc6pcx4zvv6gdhbmqvw9","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111454","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111454","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Airflow","version":"affected 2.4.0 3.0.0 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Airflow","version":"affected 3.4.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Zhixi \"Jace\" Sun, independent security researcher","lang":"en"},{"source":"CNA","value":"Jarek Potiuk","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-09T09:11:01.401Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/17"}],"title":"CVE Program Container"}],"cna":{"affected":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow","packageURL":"pkg:pypi/apache-airflow","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"2.4.0","versionType":"semver"}]},{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Zhixi \"Jace\" Sun, independent security researcher"},{"lang":"en","type":"remediation developer","value":"Jarek Potiuk"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"value":"Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T13:04:53.228Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["patch"],"url":"https://github.com/apache/airflow/pull/74836"},{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/9n0sxown9kcjkc6pcx4zvv6gdhbmqvw9"}],"source":{"discovery":"EXTERNAL"},"title":"Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read","x_generator":{"engine":"airflow-s/generate_cve_json.py"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-111454","datePublished":"2026-11-09T09:07:30.929Z","dateReserved":"2026-10-16T04:01:37.703Z","dateUpdated":"2026-11-09T13:04:53.228Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-09 10:17:04","lastModifiedDate":"2026-11-09 13:17:04","problem_types":["CWE-200","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"111454","Ordinal":"1","Title":"Apache Airflow: API: asset endpoints return scheduled/producing/","CVE":"CVE-2026-111454","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"111454","Ordinal":"1","NoteData":"Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.","Type":"Description","Title":"Apache Airflow: API: asset endpoints return scheduled/producing/"}]}}}