Vulnerability · Published Jun 1, 2026 · Assigned by apache
CVE-2026-46764Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint `GET /api/v2/eventLogs` applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow | 3.2.2 | GHSA-qphr-3mvq-v466 |
| PyPI | apache-airflow | 3.2.2 | PYSEC-2026-2354 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 – before 3.0.0 |
| Apache Software Foundation | Apache Airflow | 3.0.0 – before 3.2.2 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N