Every CVE Search/ Get API key

CVE-2026-22922

Apache Airflow: Airflow externalLogUrl Permission Bypass

6.5 MediumFix available

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.45%Up 0.4 points since Feb 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Record
CVE-2026-22922
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-648
Updated
2026-11-03
EUVDEUVD-2026-6456 6.5

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Record
EUVD-2026-6456
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-pm44-x5x7-24c4 6.5

Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

Vulnerability Overview

An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.

The Flaw

The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs).

In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific can_read permission for Logs.

Impact

  • Confidentiality Loss: Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access.
  • Broken Access Control: This bypasses the intended security model for restricted user roles.

Affected Versions

  • Apache Airflow 3.1.0 through 3.1.6

Patches

Users should upgrade to Apache Airflow 3.1.7 or later, which enforces the correct permission checks for log access.

Record
GHSA-pm44-x5x7-24c4
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-648
Updated
2026-11-02
NVD 6.5

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Record
CVE-2026-22922
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-648
Updated
2026-11-03
OSV 6.5

Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Record
CVE-2026-22922
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-648
Updated
2026-11-04
OSVGHSA-pm44-x5x7-24c4 6.5

Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

Vulnerability Overview

An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.

The Flaw

The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs).

In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific can_read permission for Logs.

Impact

  • Confidentiality Loss: Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access.
  • Broken Access Control: This bypasses the intended security model for restricted user roles.

Affected Versions

  • Apache Airflow 3.1.0 through 3.1.6

Patches

Users should upgrade to Apache Airflow 3.1.7 or later, which enforces the correct permission checks for log access.

Record
GHSA-pm44-x5x7-24c4
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-648
Updated
2026-11-02
OSVPYSEC-2026-11 6.5

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Record
PYSEC-2026-11
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-airflow-2026-22922 No score

Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Record
BIT-airflow-2026-22922
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache-airflow
PyPI
 3.1.0 up to 3.1.7
3.1.7
airflow
Bitnami
 3.1.0 up to 3.1.7
3.1.7
apache-airflow
PyPI
 3.1.0 up to 3.1.7, plus listed versions
3.1.13.1.1rc13.1.1rc23.1.23.1.2rc1
Show 12 moreShow less
3.1.2rc23.1.33.1.3rc13.1.43.1.4rc13.1.4rc23.1.53.1.5rc13.1.63.1.6rc13.1.7rc13.1.7rc2
3.1.7

History

History
RecordedChangedSources
factsCVE List, EUVD, NVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-22922 is a medium vulnerability (CVSS 6.5) in Apache Airflow, published February 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in apache-airflow 3.1.7.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open