CVE-2026-46764

The Event Log detail endpoint GET /api/v2/eventLogs/eventlogid in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-lo...

CVE-2026-46764

creationtimestamp| type| source ---|---|--- 2026-05-31 13:47:35+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn5pczsfmc2z...