CVE-2026-46764

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description The Event Log detail endpoint "GET /api/v2/eventLogs/{event log id}" fetches audit-log rows directly by numeric ID after performing only a generic Audit Log permission check. This differs from the collection endpoint "GET /api/v2/eventLogs", which applies per-Dag scoping. Consequently, an authenticated UI or API user with audit-log read permission for a single Dag can retrieve audit-log entries for any other Dag by guessing or enumerating the event log id variable.

Recommendations Upgrade to version 3.2.2 or later.