CVE WATCH / VULNERABILITY DETAIL
CVE-2026-111453
MEDIUMCVSS 4.3NVD feed
Published 9 November 2026 · tracked since 9 November 2026
Description
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124684 MEDIUM 5.1
- CVE-2026-124591 MEDIUM 5.5
- CVE-2026-123460 HIGH 7.1
- CVE-2026-120838 MEDIUM 6.5
- CVE-2026-120367 HIGH 7.5
- CVE-2026-115252 CRITICAL 10
- CVE-2026-113702 MEDIUM 4.3
- CVE-2026-106466 HIGH 7.5
- CVE-2026-106008 MEDIUM 5.3
- CVE-2026-121764 HIGH 7.1