Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
Medium6.5CVE-2026-22922 · Published Feb 9, 2026 · updated Sep 10, 2026
## Vulnerability Overview An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions. ## The Flaw The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs). In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs. ## Impact - **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles. ## Affected Versions - Apache Airflow 3.1.0 through 3.1.6 ## Patches Users should upgrade to Apache Airflow **3.1.7** or later, which enforces th...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 3.1.0, < 3.1.7 | 3.1.7 |
Details and references
## Vulnerability Overview An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions. ## The Flaw The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs). In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs. ## Impact - **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles. ## Affected Versions - Apache Airflow 3.1.0 through 3.1.6 ## Patches Users should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-648
- Also known as
- BIT-airflow-2026-22922, CVE-2026-22922, PYSEC-2026-11
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 24 | Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table High8.4Feb 24 | High8.4 | 2.11.1 |
| Feb 24 | Apache Airflow exposes sensitive information in its log filesMedium6.5Feb 24 | Medium6.5 | 2.11.1 |
| Feb 21 | Apache Airflow error reporting may expose full kwargsMedium6.5Feb 21 | Medium6.5 | 2.11.1+1 more |
| Feb 9 | Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated UsersMedium6.5Feb 9 | Medium6.5 | 3.1.7 |
| Jan 16 | Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncatedHigh7.5Jan 16 | High7.5 | 3.1.6 |
| Jan 16 | Apache Airflow proxy credentials for various providers might leak in task logsHigh7.5Jan 16 | High7.5 | 2.11.1+1 more |