Is CVE-2026-75158 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75158 being exploited in the wild.

How severe is CVE-2026-75158?

Medium severity, with a CVSS score of 4.3, published 21 September 2026.

Which products and versions are affected?

Apache Airflow before 3.3.2; apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.3.2.

Is there a fix for CVE-2026-75158?

Yes. apache-airflow (PyPI): upgrade to 3.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75158 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75158?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75158: Apache Airflow information disclosure in /assets/events API

CVE-2026-75158 · Severity: medium · CVSS 4.3 · Published 2026-09-21

Apache Airflow's `/assets/events` API endpoint disclosed asset events and metadata from all DAGs in the deployment to any authenticated user with asset-read permissions, regardless of their DAG-level access controls. An attacker could enumerate source DAG IDs, task IDs, run IDs, and event timestamps from DAGs they should not be able to see, and the pagination count also revealed the existence of hidden DAGs even without reading individual records.

Technologies: Apache Airflow, apache-airflow (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2026-75158 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75158 being exploited in the wild.
How severe is CVE-2026-75158?: Medium severity, with a CVSS score of 4.3, published 21 September 2026.
Which products and versions are affected?: Apache Airflow before 3.3.2; apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.3.2.
Is there a fix for CVE-2026-75158?: Yes. apache-airflow (PyPI): upgrade to 3.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75158 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75158?: Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 3.3.2 or later
```
pip install "apache-airflow>=3.3.2"
```

Technical details

The `/assets/events` API endpoint lacked per-DAG row filtering despite being gated on global asset-read access, allowing enumeration of all asset events across the deployment. The vulnerability affects deployments using per-DAG access control to separate teams or tenants. A fix scoping the query to readable DAGs via `PermittedAssetEventFilter` was merged in August 2026; users should upgrade to Apache Airflow 3.3.2 or later.

Affected products

Apache Airflow before 3.3.2

Identifiers

CVE-2026-75158
PYSEC-2026-3988

Timeline

2026-09-21: disclosed: CVE-2026-75158 published
2026-08-18: patched: Fix merged in PR #71741

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.