openwall.com
http://www.openwall.com/lists/oss-security/2026/02/09/2 CVE-2026-22922
MEDIUM
Apache Airflow: Airflow externalLogUrl Permission Bypass
Record summary
CVE-2026-22922 has a selected CVSS score of 6.5 (medium).
Description
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 9, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Apache AirflowBrowse Apache Software Foundation / Apache AirflowDefault status: unaffected | CVE List | 3.1.0 to < 3.1.7 | affected |
apache-airflowBrowse PyPI / apache-airflow | GitHub Advisory | 3.1.0 to < 3.1.7 · Fixed in 3.1.7 | affected |
References
6github.com
https://github.com/apache/airflow github.compatch
https://github.com/apache/airflow/pull/60412 github.com
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-11.yaml lists.apache.orgVendor advisory
https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-22922