Authentication Bypass Vulnerability in Apache Airflow

CVE-2026-46764

What is CVE-2026-46764?

A configuration oversight in Apache Airflow allows authenticated users with permissions for specific audit logs to potentially access audit-log entries from other Directed Acyclic Graphs (DAGs) by merely guessing or sequentially enumerating the numeric event log IDs. This flaw undermines the intended per-DAG permissions designed to safeguard against unauthorized data access. It is critical for users relying on per-DAG audit log scoping to update to Apache Airflow version 3.2.2 or later to mitigate this vulnerability.

References