CVE-2026-22922

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22922", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-13T14:15:57.516Z", "datePublished": "2026-02-09T10:33:49.649Z", "dateUpdated": "2026-11-03T06:52:02.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:52:02.873Z"}, "title": "Apache Airflow: Airflow externalLogUrl Permission Bypass", "problemTypes": [{"descriptions": [{"description": "CWE-648 Incorrect Use of Privileged APIs", "lang": "en", "cweId": "CWE-648", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow-core", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "3.1.7", "versionType": "semver"}], "defaultStatus": "unaffected", "packageURL": "pkg:pypi/apache-airflow-core"}], "descriptions": [{"value": "Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. \n\nUsers are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. <br><br>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.<br>"}]}], "references": [{"url": "https://github.com/apache/airflow/pull/60412", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "credits": [{"lang": "en", "value": "34selen", "type": "finder"}, {"lang": "en", "value": "Shubham Raj", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T16:31:30.265640Z", "id": "CVE-2026-22922", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T16:31:35.099Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/09/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-09T17:18:51.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/09/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-09T17:18:51.694Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-22922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T16:31:30.265640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T16:31:20.518Z"}}], "cna": {"title": "Apache Airflow: Airflow externalLogUrl Permission Bypass", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "34selen"}, {"lang": "en", "type": "remediation developer", "value": "Shubham Raj"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "3.1.7", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow-core", "packageName": "apache-airflow-core", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/60412", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. \n\nUsers are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.", "supportingMedia": [{"type": "text/html", "value": "Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. <br><br>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-648", "description": "CWE-648 Incorrect Use of Privileged APIs"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:52:02.873Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22922", "state": "PUBLISHED", "dateUpdated": "2026-11-03T06:52:02.873Z", "dateReserved": "2026-01-13T14:15:57.516Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-02-09T10:33:49.649Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-core", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.1.7", "status": "affected", "version": "3.1.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "ECDF2B6E-5E76-479A-A5F5-8A867A5176FB", "versionEndExcluding": "3.1.7", "versionStartIncluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. \n\nUsers are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue."}, {"lang": "es", "value": "Las versiones 3.1.0 a 3.1.6 de Apache Airflow contienen una falla de autorizaci\u00f3n que puede permitir a un usuario autenticado con permisos personalizados limitados al acceso a tareas ver los registros de tareas sin tener acceso a los registros de tareas.\n\nSe recomienda a los usuarios actualizar a Apache Airflow 3.1.7 o posterior, lo que resuelve este problema."}], "id": "CVE-2026-22922", "lastModified": "2026-11-03T07:18:26.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22922", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T16:31:30.265640Z", "version": "2.0.3"}}]}, "published": "2026-02-09T11:16:13.187", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/airflow/pull/60412"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/02/09/2"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-648"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.1.0,3.1.7)"}}], "product": "airflow", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-17T21:28:47.572411+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Airflow to version 3.1.7 or later, which contains the fix for the authorization issue.", "Review and adjust custom permission sets to ensure that users who can access tasks cannot also read task logs unless explicitly allowed.", "Verify that the externalLogUrl feature is properly restricted or disabled in the Airflow configuration to eliminate the exposure."], "summary": {"action": "Patch", "impact": "Information Disclosure via Permission Bypass"}, "threat_synthesis": {"affected_systems": "The affected products are Apache Airflow, specifically all releases from version 3.1.0 up to and including 3.1.6. Any instance operating within this version range is susceptible unless configured otherwise or updated to a patched release.", "description_and_impact": "Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that permits an authenticated user who has been granted only task\u2011level access to view task logs via the externalLogUrl endpoint. This flaw allows the denial of a normal authorization safeguard and results in unintended information disclosure. The vulnerability is classified as CWE\u2011648, highlighting a weakness in access control enforcement.", "risk_and_exploitability": "The flaw carries a medium CVSS score of 6.5 and an EPSS score below 1\u202f%, indicating a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog at present. Exploitation requires an authenticated user who has been granted task\u2011access permissions, and then the attacker uses the externalLogUrl feature to retrieve log data they would otherwise not be authorized to read."}}}}, "created": "2026-02-10T11:06:54.985391+00:00", "updated": "2026-04-17T21:30:28.394989+00:00", "vendors": ["apache", "apache$PRODUCT$airflow"]}