CVE-2026-22922

unknown

Published 2026-02-09 · Modified 2026-05-20

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2

—

VIR risk

—

Description

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	apache-airflow	`>=3.1.0,<3.1.7`	`3.1.7`

References

https://nvd.nist.gov/vuln/detail/CVE-2026-22922
https://github.com/apache/airflow/pull/60412
https://github.com/apache/airflow
https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
http://www.openwall.com/lists/oss-security/2026/02/09/2

Verify integrity in audit chain (admin only). AS-IS.