GHSA-PM44-X5X7-24C4
Vulnerability from github – Published: 2026-02-09 12:30 – Updated: 2026-02-13 18:20
VLAI?
Summary
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
Details
Vulnerability Overview
An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.
The Flaw
The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs).
In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific can_read permission for Logs.
Impact
- Confidentiality Loss: Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access.
- Broken Access Control: This bypasses the intended security model for restricted user roles.
Affected Versions
- Apache Airflow 3.1.0 through 3.1.6
Patches
Users should upgrade to Apache Airflow 3.1.7 or later, which enforces the correct permission checks for log access.
Severity ?
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-22922"
],
"database_specific": {
"cwe_ids": [
"CWE-648"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-11T21:40:06Z",
"nvd_published_at": "2026-02-09T11:16:13Z",
"severity": "MODERATE"
},
"details": "## Vulnerability Overview\n\nAn authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.\n\n## The Flaw\n\nThe vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate \"Task\" access (viewing the task state) from \"Task Log\" access (viewing the console output/logs).\n\nIn affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs.\n\n## Impact\n\n- **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access.\n- **Broken Access Control:** This bypasses the intended security model for restricted user roles.\n\n## Affected Versions\n\n- Apache Airflow 3.1.0 through 3.1.6\n\n## Patches\n\nUsers should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.",
"id": "GHSA-pm44-x5x7-24c4",
"modified": "2026-02-13T18:20:21Z",
"published": "2026-02-09T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22922"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/60412"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…