affected:
- package:
    ecosystem: PyPI
    name: apache-airflow
    purl: pkg:pypi/apache-airflow
  ranges:
  - events:
    - introduced: 3.1.0
    - fixed: 3.1.7
    type: ECOSYSTEM
  versions:
  - 3.1.0
  - 3.1.1
  - 3.1.1rc1
  - 3.1.1rc2
  - 3.1.2
  - 3.1.2rc1
  - 3.1.2rc2
  - 3.1.3
  - 3.1.3rc1
  - 3.1.4
  - 3.1.4rc1
  - 3.1.4rc2
  - 3.1.5
  - 3.1.5rc1
  - 3.1.6
  - 3.1.6rc1
  - 3.1.7rc1
  - 3.1.7rc2
aliases:
- CVE-2026-22922
- GHSA-pm44-x5x7-24c4
details: "Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw
  that can allow an authenticated user with custom permissions limited to task access
  to view task logs without having task log access. \n\nUsers are recommended to upgrade
  to Apache Airflow 3.1.7 or later, which resolves this issue."
id: PYSEC-2026-11
modified: '2026-05-20T09:18:52.733224Z'
published: '2026-02-09T11:16:13.187Z'
references:
- type: ADVISORY
  url: http://www.openwall.com/lists/oss-security/2026/02/09/2
- type: ADVISORY
  url: https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
- type: FIX
  url: https://github.com/apache/airflow/pull/60412
- type: ADVISORY
  url: https://github.com/advisories/GHSA-pm44-x5x7-24c4
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3