CVE-2026-22922
📋 TL;DR
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw where authenticated users with custom permissions limited to task access can view task logs without proper authorization. This affects organizations running vulnerable Airflow instances with custom permission configurations. The vulnerability allows unauthorized access to potentially sensitive log data.
💻 Affected Systems
- Apache Airflow
📦 What is this software?
Airflow by Apache
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker with limited permissions could access sensitive task logs containing credentials, API keys, or other confidential data, leading to data exposure and potential lateral movement.
Likely Case
Users with legitimate but limited task permissions could inadvertently or intentionally view logs they shouldn't have access to, violating data access policies and potentially exposing operational data.
If Mitigated
With proper network segmentation and minimal user permissions, impact is limited to unauthorized log viewing within the Airflow instance.
🎯 Exploit Status
Exploitation requires authenticated access and custom permission configurations. The vulnerability is in authorization logic, not authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache Airflow 3.1.7 or later
Vendor Advisory: https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
Restart Required: Yes
Instructions:
1. Backup your Airflow configuration and database. 2. Upgrade to Airflow 3.1.7 or later using pip: 'pip install --upgrade apache-airflow==3.1.7'. 3. Restart all Airflow services. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Custom Permissions
allTemporarily remove or restrict custom permissions that grant task access without proper log authorization checks.
Review and modify Airflow RBAC configurations to ensure task log permissions are properly scoped
Disable Task Log Access
allDisable task log viewing for all users except administrators until patching can be completed.
Modify Airflow's webserver_config.py to restrict 'can_read' permissions on task logs
🧯 If You Can't Patch
- Implement strict network access controls to limit Airflow access to authorized users only
- Enable detailed audit logging for all task log access attempts and monitor for unauthorized access patterns
🔍 How to Verify
Check if Vulnerable:
Check Airflow version: if running 3.1.0-3.1.6 with custom permissions configured, the system is vulnerable.Check Version:
airflow versionVerify Fix Applied:
After upgrading to 3.1.7+, verify that users with custom task permissions cannot access task logs without explicit log permissions.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to task logs in Airflow audit logs
- Users with limited permissions accessing task log endpoints
Network Indicators:
- HTTP requests to /api/v1/dags/*/dagRuns/*/taskInstances/*/logs from unauthorized users
SIEM Query:
source="airflow" AND (uri_path="/api/v1/dags/*/dagRuns/*/taskInstances/*/logs" OR event="task_log_access") AND user_permissions!="*log*"