CVE-2026-46764: Apache Airflow Audit Log Authorization Bypass – IDOR Vulnerability

Technical summary

CVE-2026-46764 is an Insecure Direct Object Reference (IDOR) vulnerability in Apache Airflow's `/api/v2/eventLogs/{event_log_id}` endpoint. The vulnerability exists because the detail endpoint retrieves audit-log rows by numeric ID using only a coarse-grained audit-log read permission check, without enforcing the per-Dag authorization context that applies to the collection endpoint (`GET /api/v2/eventLogs`). An authenticated attacker can iterate through numeric event_log_id values and retrieve entries for Dags outside their granted scope. The root cause is a logic gap between two related endpoints—one implements proper authorization scoping, the other does not. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Business impact

Organizations using Apache Airflow with multi-tenant or role-based access controls that rely on per-Dag audit-log isolation face information disclosure risk. Audit logs often contain sensitive data: task parameters, credentials in logs, query details, failure reasons, and execution history. A user with minimal Dag access (e.g., development environment) could read audit entries from production or restricted Dags, violating compliance requirements (SOC 2, HIPAA, PCI-DSS auditing controls) and exposing operational intelligence. In regulated environments, this may trigger breach notification obligations if sensitive data (PII, API keys, database credentials) appears in audit logs. The impact is limited to confidentiality; audit logs themselves cannot be modified or deleted through this vector.

Affected systems

Apache Airflow versions prior to 3.2.2 are affected. The vulnerability impacts only deployments that (1) use Airflow's UI or REST API v2, (2) have multiple Dags with different access restrictions, and (3) rely on per-Dag audit-log scoping for security or compliance. Single-tenant Airflow instances or those without multi-Dag segregation have reduced exposure. Organizations using API authentication with audit-log read permissions should assume they are vulnerable until patched.

Exploitability

Exploitability is moderate. An attacker requires valid Airflow credentials with at least read access to audit logs—a common permission for operational staff, DevOps engineers, or analysts. No special configuration or elevated privileges are needed. The detail endpoint is network-accessible and unauthenticated requests are rejected, so an attacker must have valid API tokens or UI session cookies. However, once authenticated, the attack requires only simple HTTP GET requests with incremented event_log_id values; no sophisticated tooling is needed. Event log IDs are sequential numeric values, making enumeration trivial. The CVSS score of 4.3 (Medium) reflects that exploitation requires authentication and only results in low-impact information disclosure, but the ease of discovery and exploitation within an authenticated context is significant.

Remediation

Upgrade Apache Airflow to version 3.2.2 or later. Patch versions will enforce per-Dag authorization scoping on the detail endpoint, matching the collection endpoint's logic. No configuration workarounds are available in older versions. Organizations unable to patch immediately should implement network-layer controls: restrict API access to the `/api/v2/eventLogs` endpoint to trusted internal networks, disable the detail endpoint if not actively used, or implement API gateway rules that validate the requester's Dag permissions before forwarding requests.

Patch guidance

Verify the installed version of Apache Airflow (check `airflow version` command or package metadata). Consult the official Apache Airflow release notes and security advisories for version 3.2.2 and any subsequent patches. Follow your organization's standard deployment process for upgrading Airflow: test patches in a non-production environment, verify that audit-log permissions continue to enforce per-Dag scoping post-upgrade, and confirm no custom authorization policies are inadvertently bypassed. If Airflow runs in a container or Kubernetes environment, update your base image or Helm chart to include the patched version. Confirm that the `/api/v2/eventLogs/{event_log_id}` endpoint now rejects requests from users lacking access to the requested Dag's logs.

Detection guidance

Review audit-log access patterns for anomalies: look for authenticated users requesting event_log_id values outside their expected Dag scope (correlate API access logs with Airflow permission roles). Monitor the `/api/v2/eventLogs/{event_log_id}` endpoint for high-frequency requests with varying IDs, which may indicate enumeration attempts. Check Airflow's access control logs to identify which users have audit-log read permissions; remove or restrict permissions for users who do not require them. If SIEM or WAF is in place, write detection rules for repeated 200 responses from the detail endpoint followed by access to unrelated Dag identifiers. Engage with log retention and analysis to identify if audit data has been exfiltrated (search for API access to event logs outside normal operational windows).

Why prioritize this

Prioritize patching based on deployment sensitivity: highest urgency for multi-tenant Airflow instances with strict data isolation requirements, production systems handling regulated data, and deployments where audit-log read permissions are granted to users outside the core operations team. Medium urgency for development or staging Airflow instances, or those with homogeneous Dag access (where many users have access to most Dags anyway). The CVSS score is Medium (4.3), but real-world impact may be higher if audit logs contain credentials, API keys, or PII—assess your audit-log content before deprioritizing. The vulnerability requires authentication and produces no direct operational impact, so it is lower priority than remote-code-execution or authentication-bypass flaws, but higher priority than issues affecting only unavailability.

Risk score, explained

CVE-2026-46764 scores 4.3 (Medium severity) under CVSS 3.1. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N breaks down as: Attack Vector (Network) reflects that the vulnerability is accessible over the network via REST API; Attack Complexity (Low) indicates no special conditions or timing are required; Privileges Required (Low) because an authenticated user with audit-log read permission can exploit it; User Interaction (None) because the attacker triggers exploitation directly; Scope (Unchanged) because the impact is confined to the affected Airflow system; Confidentiality (Low) because only audit-log data is leaked, not arbitrary system data; Integrity and Availability (None) because the attack does not modify or delete data, nor does it degrade performance. The score reflects a real but limited exposure: the vulnerability is easily exploitable by a category of user (authenticated with audit permissions) but the harm is restricted to information disclosure of audit records.

Frequently asked questions