PT-2026-7102 · Apache · Apache Airflow

34Selen + 1 · Published 2026-02-09 · Updated 2026-02-12 · CVE-2026-22922

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.6

Description An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects systems where users have custom permissions restricting access to task logs, but still permit task access.

Recommendations Upgrade to Apache Airflow version 3.1.7 or later.

Fix

Weakness Enumeration

CWE-648

Related Identifiers

BIT-AIRFLOW-2026-22922

CVE-2026-22922

GHSA-PM44-X5X7-24C4

PYSEC-2026-11

Affected Products

Apache Airflow

References · 14

• https://github.com/apache/airflow/pull/60412 · Patch
• https://osv.dev/vulnerability/CVE-2026-22922 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pm44-x5x7-24c4 · Vendor Advisory
• https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-22922 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22922 · Security Note
• https://github.com/apache/airflow · Note
• http://openwall.com/lists/oss-security/2026/02/09/2 · Note
• https://twitter.com/oss_security/status/2020917728635146362 · Twitter Post
• https://twitter.com/CVEnew/status/2020810669159846367 · Twitter Post
• https://t.me/CVEtracker/44200 · Telegram Post
• https://t.me/cveNotify/151390 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2020907099916501375 · Twitter Post