CVE-2026-22922
published 2026-02-09CVE-2026-22922: Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.38%
30.2th percentile
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.
Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | >= 3.1.0 < 3.1.7 | 3.1.7 |
| apache_software_foundation | apache_airflow | >= 3.1.0 < 3.1.7 | 3.1.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
ghsa·2026-02-09
CVE-2026-22922 [MEDIUM] CWE-648 Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
## Vulnerability Overview
An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.
## The Flaw
The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs).
In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs.
## Impact
- *
OSV
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
osv·2026-02-09
CVE-2026-22922 [MEDIUM] Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
## Vulnerability Overview
An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.
## The Flaw
The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs).
In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs.
## Impact
- *
No detection rules found.
No public exploits indexed.
2026-02-09
Published