PT-2026-7102

CVE-2026-22922

Published

2026-02-09

Updated

2026-02-12

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.6

Description An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects systems where users have custom permissions restricting access to task logs, but still permit task access.

Recommendations Upgrade to Apache Airflow version 3.1.7 or later.

Exploitability

Exploit

Fix

Researchers

34Selen

Shubham Raj

Vendors

Affected products

Weakness enumeration

CWE-648: Incorrect Use of Privileged APIs

Related identifiers