CVE-2026-46764: Apache Airflow Authorization Bypass Through User-Controlled Key
Summary
CVE-2026-46764: Apache Airflow has an Authorization Bypass Through User-Controlled Key. Affects apache-airflow versions < 3.2.2. Fixed in 3.2.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-46764 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define complex workflows as directed acyclic graphs (DAGs) and provides a rich user interface for managing and visualizing these workflows. However, a vulnerability has been identified that affects the security of audit logs, potentially allowing unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from the Event Log detail endpoint (GET /api/v2/eventLogs/{event_log_id}) in Apache Airflow, which fetches audit-log rows directly by numeric ID after only performing a generic Audit Log permission check. This means that an authenticated user with read permission for one DAG could exploit this flaw to access audit-log entries for any other DAG by simply guessing or enumerating the numeric event log ID. This could lead to unauthorized disclosure of sensitive information across different workflows, affecting deployments that rely on per-DAG audit-log scoping.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by upgrading to the fixed version.
Conclusion
The CVE-2026-46764 vulnerability in Apache Airflow poses a significant risk by allowing unauthorized access to audit logs. It is crucial for users to upgrade to version 3.2.2 or later to protect their deployments from potential data breaches. Regular monitoring and updates are essential for maintaining the security of open-source applications.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2026-46764 is a vulnerability in Apache Airflow that allows an authenticated user to bypass authorization checks and access audit logs for different DAGs.
This vulnerability can lead to unauthorized access to sensitive audit log information, potentially exposing data across different workflows.
Versions prior to 3.2.2 are affected by this vulnerability. Users should upgrade to 3.2.2 or later to mitigate the risk.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a monitoring tool that uses Pipfile.lock to track and alert in real-time for open-source vulnerabilities in software, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
