CVE-2026-22922

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22922
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22922.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22922
Aliases
Downstream
Related
Published
2026-02-09T10:33:49.649Z
Modified
2026-07-15T01:49:09.895420716Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Airflow: Airflow externalLogUrl Permission Bypass
Details

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-648"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22922.json",
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/airflow

Affected ranges

Type
GIT
Repo
https://github.com/apache/airflow
Events
Introduced
8cdef3e855527b8a431666b0ce9f3ffd43d14955
Fixed
dc8ffa291b8b0c582cb639c9f3a3c3fd2a96ecf2
Database specific 
{
    "cpe": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "3.1.7"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22922.json"