PT-2026-45375 · Apache · Apache Airflow

Jarek Potiuk + 1 · Published 2026-06-01 · Updated 2026-06-05 · CVE-2026-45426

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description The Log server authorizes JWT tokens against Dag IDs by applying the str.lstrip() function to the requested path segment when verifying the sub claim. Because str.lstrip() removes any character from a specified set rather than a specific prefix, a token issued for one Dag can authorize access to any other Dag whose name begins with any subset of the characters in the original Dag's name. This allows an authenticated Airflow worker with a valid Log-server JWT to enumerate and read logs of other Dags, potentially leaking task output and error traces. This issue affects deployments using per-Dag log-access scoping, such as multi-team, shared-executor, or shared-worker topologies.

Recommendations Upgrade to version 3.2.2 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-AIRFLOW-2026-45426

CVE-2026-45426

PYSEC-2026-174

Affected Products

Apache Airflow

References · 8

• https://github.com/apache/airflow/pull/66749 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-174 · Vendor Advisory
• https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45426 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2026-45426 · Vendor Advisory
• https://twitter.com/_alphashark_/status/2061715028055924981 · Twitter Post
• https://t.me/CVEtracker/55457 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/31/13 · Note