PT-2026-45378 · Apache · Apache Airflow

Pierre Jeambrun · CVE-2026-46764 · Published 2026-06-01 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description The Event Log detail endpoint "GET /api/v2/eventLogs/{event log id}" fetches audit-log rows directly by numeric ID after performing only a generic Audit Log permission check. This differs from the collection endpoint "GET /api/v2/eventLogs", which applies per-Dag scoping. Consequently, an authenticated UI or API user with audit-log read permission for a single Dag can retrieve audit-log entries for any other Dag by guessing or enumerating the event log id variable.

Recommendations Upgrade to version 3.2.2 or later.

Exploit

Fix

DoS

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BIT-AIRFLOW-2026-46764

CVE-2026-46764

ECHO-B9E9-15F1-BF82

GHSA-QPHR-3MVQ-V466

PYSEC-2026-2354

Affected Products

Apache Airflow

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46764.json · Exploit
• https://github.com/apache/airflow/pull/67112 · Patch
• https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qphr-3mvq-v466 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-46764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46764 · Security Note
• https://osv.dev/vulnerability/CVE-2026-46764 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2354 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/advisories/GHSA-qphr-3mvq-v466 · Note
• https://pypi.python.org · Note
• https://t.me/CVEtracker/55460 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/31/14 · Note
• https://pypi.org/project/apache-airflow · Note