PT-2026-7102 · Apache · Apache Airflow

34Selen + 1 · CVE-2026-22922 · Published 2026-02-09 · Updated 2026-02-12

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.6

Description An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects systems where users have custom permissions restricting access to task logs, but still permit task access.

Recommendations Upgrade to Apache Airflow version 3.1.7 or later.

Exploit

Fix

Weakness Enumeration

CWE-648

Related Identifiers

BIT-AIRFLOW-2026-22922

CVE-2026-22922

GHSA-PM44-X5X7-24C4

PYSEC-2026-11

Affected Products

Apache Airflow

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22922.json · Exploit
• https://github.com/apache/airflow/pull/60412 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22922 · Security Note
• https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pm44-x5x7-24c4 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-11 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-22922 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22922 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-11.yaml · Note
• http://openwall.com/lists/oss-security/2026/02/09/2 · Note
• https://twitter.com/CVEnew/status/2020810669159846367 · Twitter Post
• https://github.com/advisories/GHSA-pm44-x5x7-24c4 · Note
• https://twitter.com/VulmonFeeds/status/2020907099916501375 · Twitter Post
• https://twitter.com/oss_security/status/2020917728635146362 · Twitter Post