A high-severity authorization flaw in Apache Airflow allows authenticated users to manipulate scheduling state by deleting queued asset events, potentially causing critical workflow disruptions.

The vulnerability stems from an incorrect authorization check (CWE-863) where the application uses a READ permission instead of an EDIT permission when processing DELETE requests for queued asset events. This allows any authenticated user with read access to a specific Directed Acyclic Graph to perform state-changing operations that should be restricted to users with write privileges.

The ability for unauthorized users to delete queued asset events poses a significant risk to business continuity and data integrity. By silently suppressing asset-triggered scheduling, an attacker can prevent essential automated workflows from executing, leading to operational delays or failures in data processing pipelines. With a CVSS score of 7.5, this vulnerability represents a substantial threat to the reliability of automated infrastructure.

Immediate Action: Update Apache Airflow to version 3.3.2 or later to apply the necessary authorization logic corrections.

Proactive Monitoring: Review access logs for suspicious DELETE requests targeting the asset queued-events endpoints, particularly from users with limited read-only roles.

Compensating Controls: Restrict access to the Airflow web interface to trusted users via network-level controls or VPNs, and ensure that Role-Based Access Control (RBAC) configurations adhere to the principle of least privilege.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub repository.

Given the ease with which this authorization bypass can be exploited to disrupt automated workflows, organizations should prioritize upgrading their Apache Airflow deployments to version 3.3.2. Organizations that cannot immediately patch should perform an urgent audit of existing RBAC permissions to ensure that read-only users do not have excessive access to DAG assets. Failure to address this vulnerability could lead to significant operational downtime for mission-critical data pipelines.