CVE-2026-46764 Details
Description
The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint `GET /api/v2/eventLogs` applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
A vulnerability exists in the Apache Airflow Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` prior to version 3.2.2. This endpoint retrieves audit-log rows by numeric ID, after only a basic Audit Log permission check. In contrast, the collection endpoint `GET /api/v2/eventLogs` enforces per-DAG permission scoping. As a result, an authenticated user with audit-log read permission for one DAG could access audit-log entries for other DAGs by guessing or enumerating event log IDs. This issue affects deployments that depend on per-DAG audit-log scoping.
Users are advised to upgrade to Apache Airflow version 3.2.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/31/14 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/67112 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.2.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | New CVE Received | [email protected] |
| Jun 1, 2026 | CVE Modified | CVE |