CVE-2026-46764: Apache Airflow Auth Bypass Vulnerability

CVE-2026-46764 Overview

CVE-2026-46764 is an Insecure Direct Object Reference (IDOR) vulnerability in Apache Airflow's audit log API. The Event Log detail endpoint GET /api/v2/eventLogs/{event_log_id} fetched rows directly by numeric ID after only a generic Audit Log permission check. The collection endpoint GET /api/v2/eventLogs correctly applied per-Dag scoping, creating an inconsistency. An authenticated user with audit-log read permission for a single Dag can enumerate numeric IDs to retrieve audit-log entries belonging to any other Dag. The flaw is tracked under [CWE-639] and affects deployments that rely on per-Dag audit-log scoping for tenant isolation.

Critical Impact
Authenticated users can read audit-log entries for Dags outside their authorization scope by enumerating numeric event log IDs.

Affected Products

Apache Airflow versions prior to 3.2.2
Deployments enforcing per-Dag audit-log access control
Apache Airflow REST API v2 consumers

Discovery Timeline

2026-06-01 - CVE-2026-46764 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-46764

Vulnerability Analysis

Apache Airflow exposes audit-log data through two REST endpoints. The collection endpoint GET /api/v2/eventLogs filters results based on the calling user's per-Dag audit-log permissions. The detail endpoint GET /api/v2/eventLogs/{event_log_id} skipped that scoping step. It validated only the generic Audit Log read permission, then loaded the row by primary key.

This asymmetry breaks the security model. A user authorized to read audit data for one Dag retains object-level permission to that resource type, which the detail endpoint accepts as sufficient. The endpoint returns the requested row regardless of which Dag produced it.

Root Cause

The root cause is missing object-level authorization on the detail endpoint. The handler applied a coarse role check but did not verify that the requested event_log_id belonged to a Dag the caller could access. This is a textbook Insecure Direct Object Reference, classified under [CWE-639] (Authorization Bypass Through User-Controlled Key).

Attack Vector

Exploitation requires an authenticated session and audit-log read permission for at least one Dag. The attacker iterates numeric event_log_id values and issues GET /api/v2/eventLogs/{id} for each. The server returns audit records for Dags the attacker does not own, exposing task execution metadata, configuration changes, and user actions across tenants. The attack vector is network-based with low complexity and requires no user interaction.

No public proof-of-concept code is available. See the Apache Airflow Pull Request 67112 for the upstream fix and the Apache mailing list advisory for vendor disclosure details.

Detection Methods for CVE-2026-46764

Indicators of Compromise

Sequential or enumerative GET /api/v2/eventLogs/{id} requests from a single authenticated session
API access logs showing a user retrieving event log IDs that do not appear in their corresponding GET /api/v2/eventLogs collection responses
Spikes in 200 responses on the detail endpoint paired with low or zero hits on the collection endpoint for the same user

Detection Strategies

Correlate Airflow webserver access logs to identify users requesting event log detail records outside the Dag IDs they own
Alert on rapid sequential numeric ID enumeration patterns against /api/v2/eventLogs/
Apply rate-limit thresholds on the detail endpoint and flag accounts exceeding normal usage baselines

Monitoring Recommendations

Forward Airflow API and audit logs to a centralized SIEM for cross-Dag access correlation
Track authentication tokens by Dag scope and alert when a token accesses event logs outside its declared scope
Review historical API logs from before patching to identify prior enumeration activity

How to Mitigate CVE-2026-46764

Immediate Actions Required

Upgrade Apache Airflow to version 3.2.2 or later
Audit user role assignments and remove unnecessary audit-log read permissions
Review API access logs for prior enumeration of the eventLogs detail endpoint

Patch Information

The fix is delivered in apache-airflow 3.2.2. The patch enforces per-Dag scoping on the detail endpoint to match the collection endpoint's behavior. See Apache Airflow Pull Request 67112 for the code change and the OpenWall OSS Security advisory for the official notice.

Workarounds

Restrict Audit Log read permission to administrative roles until the upgrade is applied
Place the Airflow REST API behind a reverse proxy that blocks or rate-limits GET /api/v2/eventLogs/{id} for non-admin users
Disable the REST API event log endpoints if audit-log access through the API is not required

bash

# Upgrade Apache Airflow to the patched release
pip install --upgrade 'apache-airflow==3.2.2'

# Verify the installed version
airflow version