EUVD-2026-33584
GHSA-qphr-3mvq-v466
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
The event log detail endpoint in Apache Airflow before 3.2.2 applies a generic DAG-level audit log permission check rather than scoping authorization to the specific DAG that owns the requested event log entry, allowing any authenticated low-privilege user to read audit log entries belonging to DAGs outside their permitted scope. The flaw is a broken object-level authorization (IDOR) pattern - classified as CWE-639 - where the user-supplied event_log_id path parameter can reference log rows from unauthorized DAGs without triggering a rejection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account (PR:L) that holds at least read permission on `DagAccessEntity.AUDIT_LOG` for one or more DAGs within the Airflow deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a medium-severity, network-reachable, low-complexity, authenticated information disclosure with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Airflow user who has been granted audit-log read access for a single DAG (e.g., a developer restricted to `dag_A`) sends sequential or enumerated `GET /eventLogs/{id}` requests to the public API. Because the pre-3.2.2 authorization check verifies only the generic DAG audit-log permission and does not resolve the owning DAG of each event log row, the API returns full event log detail records belonging to `dag_B`, `dag_C`, or any other DAG in the system. … |
| Remediation | Upgrade to Apache Airflow 3.2.2 or later, which replaces the generic `requires_access_dag` guard on the event log detail endpoint with the new `requires_access_event_log` dependency that performs per-row DAG-scoped authorization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in StarTree mcp-pinot versions 3.0.1 and earlier exposes the Model Context Protocol HTTP server on
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Cross-user flow execution in Langflow versions prior to 1.9.1 allows any authenticated API user to run another user's fl
Unauthenticated remote code execution in Crawl4AI versions <= 0.8.6 allows attackers to escape the AST-based sandbox in
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co
Share
External POC / Exploit Code
Leaving vuln.today