| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow | < 3.2.2 | 3.2.2 |
| airflow | < 3.2.2 | 3.2.2 |
The Event Log detail endpoint GET /api/v2/eventLogs/{event_log_id} in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to apache-airflow 3.2.2 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free