CVE-2026-46764— Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | < 3.2.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-46764
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
Source: CVE Program / CVE List V5
Vulnerability Description
The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint `GET /api/v2/eventLogs` applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Airflow 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Airflow是美国阿帕奇（Apache）基金会的一套具有创建、管理和监控工作流程功能的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow 3.2.2之前版本存在安全漏洞，该漏洞源于事件日志端点缺少按Dag范围检查，可能导致已认证用户通过猜测或枚举数字事件日志ID检索其他Dag的审计日志条目。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 ~ 3.2.2 | - |
II. Public POCs for CVE-2026-46764
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46764
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-46764 (1)
Mailing List Discussions for CVE-2026-46764 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-01 · 28 CVEs total
| CVE-2026-44825 | 8.1 HIGH | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users |
| CVE-2026-48827 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | |
| CVE-2026-49328 | Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF | |
| CVE-2026-49361 | Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | |
| CVE-2026-40961 | Apache Airflow: Open Redirect Bypass Vulnerability | |
| CVE-2026-40963 | Apache Airflow: DAG authorization bypass on /ui/structure/structure_data | |
| CVE-2026-41014 | Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints | |
| CVE-2026-49267 | Apache Airflow: No certificate validation on SMTP STARTTLS connections | |
| CVE-2026-41017 | Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-termin | |
| CVE-2026-41084 | Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation | |
| CVE-2026-42252 | Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user patter | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | |
| CVE-2026-45192 | Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response | |
| CVE-2026-42359 | Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDD | |
| CVE-2026-45360 | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | |
| CVE-2026-45426 | Apache Airflow: Log server JWT authorization bypass via Python lstrip() character strippin | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout | |
| CVE-2026-49298 | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Airflow
- CVE-2026-59244
Apache Airflow: Secrets masker: `var.json` Variable values n - CVE-2026-58076
Apache Airflow: Unguarded import_string() of airflow_exc_ser - CVE-2026-59242
Apache Airflow: Arbitrary airflow.* class instantiation on t - CVE-2026-54183
Apache Airflow: Airflow Variables were not masked in the UI - CVE-2026-67260
Apache Airflow: DAG-author remote code execution on the Sche
Same vendor: Apache Software Foundation
- CVE-2026-63044
Apache InLong: Authenticated SSRF via POST /api/node/testCon - CVE-2026-63043
Apache InLong: Agent path traversal via unvalidated file sou - CVE-2026-63042
Apache InLong: Missing authorization on DataNode management - CVE-2026-63040
Apache InLong: Missing authorization in StreamSource forceDe - CVE-2026-63039
Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-
Same weakness: CWE-639
- CVE-2026-64969
Insecure Direct Object Reference in ATutor - CVE-2026-64961
Authentication Bypass in ATutor - CVE-2026-76634
WeGIA < 3.9.2 Insecure Direct Object Reference via profile_f - CVE-2026-77081
n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node - CVE-2026-77079
n8n before 2.34.1 Authorization Bypass via Custom Role Delet
V. Comments for CVE-2026-46764
No comments yet