CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2026-22922
Medium (6.5) in apache airflow. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in apache-airflow 3.1.7.
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.
Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-648
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:airflow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pm44-x5x7-24c4 | PyPI | apache-airflow | >=3.1.0 <3.1.7 | 3.1.7 |
| PYSEC-2026-11 | PyPI | apache-airflow | >=3.1.0 <3.1.7 | 3.1.7 |