Vulnerability · Published Feb 9, 2026 · Assigned by apache
CVE-2026-22922Apache Airflow: Airflow externalLogUrl Permission Bypass
Medium 6.5
In plain English
A medium-severity security flaw in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow | 3.1.7 | GHSA-pm44-x5x7-24c4 |
| PyPI | apache-airflow | 3.1.7 | PYSEC-2026-11 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow | 3.1.0 – before 3.1.7 |
Weakness: CWE-648 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N