CVE-2026-46764: Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
The Event Log detail endpoint GET /api/v2/eventLogs/{eventlogid} in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to apache-airflow 3.2.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46764?
The severity of CVE-2026-46764 is rated as medium with a CVSS score of 4.3.
How do I fix CVE-2026-46764?
You can fix CVE-2026-46764 by applying the available patch provided in the Apache Airflow repository.
What does CVE-2026-46764 affect?
CVE-2026-46764 affects the Event Log detail endpoint in Apache Airflow.
What type of access does CVE-2026-46764 allow?
CVE-2026-46764 allows authenticated users to bypass DAG-scoped event log permission filters.
When was CVE-2026-46764 published?
CVE-2026-46764 was published on May 31, 2026.