In plain words
Imagine you have a shared calendar where people can add events, but only certain people are allowed to delete events. In this case, Apache Airflow had a flaw where anyone who could view a certain type of calendar entry, called a Dag¹, could also delete related events, even though they were not supposed to have that power.
What's broken
The bug is in Apache Airflow's queued-events DELETE endpoints, which are supposed to check if a user has the Dag EDIT¹ permission before allowing them to delete asset events. However, due to the flaw, it checked for the Dag READ¹ permission instead, which is a lower level of access. This means any authenticated user who could read a Dag could delete its queued asset events, which could silently suppress asset-triggered scheduling. The affected versions are Apache Airflow before 3.3.2.
How it actually works
Here's how it works: when a user tries to delete an asset event, the system checks their permissions. Normally, it should check if they have the EDIT¹ permission for that Dag, which would allow them to make changes. But because of the flaw, it only checks for the READ¹ permission, which is meant for viewing only. Since many more users have READ¹ access than EDIT¹ access, this flaw allows unauthorized users to delete events they should not be able to touch. This is a problem because deleting these events can stop certain automated tasks from running, which could affect how the system works.
Proof of concept
There is a public discussion about this issue, but it's not clear from the source if there is a public proof-of-concept² that demonstrates the flaw. A proof-of-concept would show that the flaw is real and can be exploited, which would make it more urgent to fix.
Is it real
It's not clear from the source if this flaw is being actively exploited in the wild. However, since the severity is listed as low and the fix is available in Apache Airflow 3.3.2 and later, the risk is relatively limited.
What to do
To fix this issue, you should update Apache Airflow to version 3.3.2 or later. This will ensure that the DELETE endpoints are properly gated on the Dag EDIT permission, preventing unauthorized deletion of asset events.
Terms
- ¹ Dag
- , A Dag is a type of workflow or process in Apache Airflow that can be triggered by various events.
- ² proof-of-concept
- , A proof-of-concept is a demonstration that a flaw or vulnerability is real and can be exploited.