What is the CVSS score of CVE-2026-46764?

CVE-2026-46764 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-46764?

Yes, a patch is available for CVE-2026-46764. Update the affected software to the latest version immediately.

Apache Airflow CVE-2026-46764

EUVD-2026-33584 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-31

GHSA-qphr-3mvq-v466

Python Apache Deserialization Authentication Bypass Airflow

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 18:38 vuln.today

Analysis Generated

Jun 01, 2026 - 18:38 vuln.today

CVSS changed

Jun 01, 2026 - 18:37 NVD

4.3 (MEDIUM)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

May 31, 2026 - 12:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 31, 2026 - 12:45 nvd

MEDIUM 4.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 pypi packages depend on apache-airflow (4 direct, 4 indirect)

Ecosystem-wide dependent count for version 3.2.2.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

The event log detail endpoint in Apache Airflow before 3.2.2 applies a generic DAG-level audit log permission check rather than scoping authorization to the specific DAG that owns the requested event log entry, allowing any authenticated low-privilege user to read audit log entries belonging to DAGs outside their permitted scope. The flaw is a broken object-level authorization (IDOR) pattern - classified as CWE-639 - where the user-supplied event_log_id path parameter can reference log rows from unauthorized DAGs without triggering a rejection. No public exploit code exists and the issue is not listed in CISA KEV, but the attack is trivially executable by any authenticated Airflow user in a multi-tenant deployment.

Technical ContextAI

Apache Airflow's FastAPI-based public API exposes a GET /eventLogs/{event_log_id} endpoint for retrieving individual audit log entries stored in the Log database table. Prior to the fix, this endpoint was protected by the requires_access_dag('GET', DagAccessEntity.AUDIT_LOG) dependency, which verified that the requesting user held generic audit-log read rights on DAGs but did not resolve the specific dag_id bound to the requested event_log_id before making the authorization decision. CWE-639 (Authorization Bypass Through User-Controlled Key) is the root cause: the user-controlled integer key (event_log_id) determines which row is fetched, but the authorization check was not keyed to the same row's owning DAG. The fix in PR #67112 introduces a new requires_access_event_log dependency that first queries select(Log.dag_id).where(Log.id == event_log_id) and then calls requires_access_dag scoped to that specific DAG, closing the gap. The affected component is airflow-core/src/airflow/api_fastapi/core_api/routes/public/event_logs.py and the associated security middleware in security.py. CPE cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* covers all versions up to 3.2.2.

RemediationAI

Upgrade to Apache Airflow 3.2.2 or later, which replaces the generic requires_access_dag guard on the event log detail endpoint with the new requires_access_event_log dependency that performs per-row DAG-scoped authorization. The upstream code fix is confirmed merged in GitHub pull request https://github.com/apache/airflow/pull/67112, and the vendor security advisory thread is at https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv. As a compensating control for environments that cannot immediately upgrade, restrict network access to the /eventLogs/{event_log_id} API endpoint at the reverse-proxy or firewall layer to only users or service accounts whose scope already covers all DAGs, effectively eliminating cross-DAG leakage; note this will prevent legitimate scoped-user audit log access and may break downstream integrations. There is no known Airflow configuration flag to disable the vulnerable code path in place - an upgrade is the only complete remediation.