CVE-2026-22922: Apache Airflow authorization bypass in task logs

Executive brief

Apache Airflow, a platform used to schedule and monitor complex workflows, contains a security flaw that allows users to view sensitive task logs they are not authorized to see. While these users may have permission to see the status of a task, they can bypass restrictions to view the actual console output and logs. This could lead to the exposure of sensitive operational data, environment variables, or connection credentials stored within those logs.

Technical details

An authorization bypass vulnerability (CWE-648) exists in Apache Airflow due to insufficient permission checks when retrieving task execution logs. In environments utilizing custom roles or granular access control, the system fails to properly validate the specific 'can_read' permission for logs if a user already possesses general task-viewing access. An authenticated attacker with network access to the Airflow instance can exploit this to retrieve logs that may contain sensitive operational data or secrets. The issue is fixed in version 3.1.7 by enforcing stricter permission validation for log access requests.

Affected products

• Apache Airflow 3.1.0 to 3.1.6

Timeline

• 2026-02-09: disclosed
• 2026-02-09: advisory
• 2026-02-09: patched: Fixed in version 3.1.7

References

• https://api.github.com/users/saivarun3407
• https://github.com/saivarun3407
• https://api.github.com/users/saivarun3407/gists%7B/gist_id%7D
• https://api.github.com/users/saivarun3407/repos
• https://avatars.githubusercontent.com/u/47294175?v=4
• https://api.github.com/users/saivarun3407/events%7B/privacy%7D