CVE-2026-22922: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-22922 is an authorization bypass vulnerability in Apache Airflow affecting versions 3.1.0 through 3.1.6, where an authenticated user with custom permissions limited to task access can view task logs without having the required task log access permissions. The flaw was discovered by researcher "34selen" and publicly disclosed on February 9, 2026, via the oss-security mailing list. The fix was developed by Shubham Raj and merged into Apache Airflow 3.1.7. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Openwall).

The root cause is classified as CWE-648 (Incorrect Use of Privileged APIs): the externalLogUrl endpoint in Airflow's REST API (airflow/api_fastapi/core_api/routes/public/log.py) did not enforce the Task Logs permission check, unlike the log content endpoint. This allowed any authenticated user with task-level access to retrieve external log URLs — and by extension, view log content — without the intended "Task Logs" permission. The fix (PR #60412) corrects the access control so that externalLogUrl retrieval requires the same Task Logs permission as log content access (GitHub PR, Openwall).

Successful exploitation allows an authenticated low-privileged user to access task logs they should not be permitted to view, resulting in a high confidentiality impact with no integrity or availability consequences. Task logs in Apache Airflow may contain sensitive information such as credentials, API keys, connection strings, and configuration details that operators intend to restrict. The impact is scoped to the Airflow instance itself and does not enable lateral movement or privilege escalation beyond unauthorized log access (Feedly, Openwall).

1. Reconnaissance: Identify an Apache Airflow instance running versions 3.1.0–3.1.6 with the REST API exposed.
2. Obtain credentials: Authenticate as a user assigned a custom role that grants task access but explicitly lacks the "Task Logs" permission.
3. Identify target task: Browse or enumerate DAG runs and task instances accessible to the limited-permission account via the Airflow UI or API.
4. Request externalLogUrl: Send an authenticated HTTP GET request to the /api/v1/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances/{task_id}/logs or the externalLogUrl endpoint, which incorrectly omits the Task Logs permission check.
5. Access log content: Use the returned external log URL to retrieve task log content, potentially exposing credentials, API keys, or other sensitive data embedded in the logs (GitHub PR, Openwall).

• Logs: Airflow API access logs showing requests to log-related endpoints (e.g., /api/v1/dags/.../taskInstances/.../logs or externalLogUrl paths) from users whose roles do not include the Task Logs permission.
• Logs: Repeated or automated log retrieval requests from a single low-privileged user account across multiple DAGs or task instances in a short time window.
• Network: Outbound HTTP requests from the Airflow webserver to external log storage URLs (e.g., S3, GCS, remote log servers) triggered by accounts not expected to access logs.

The primary remediation is to upgrade Apache Airflow to version 3.1.7 or later, which corrects the permission check on the externalLogUrl endpoint. As a temporary workaround, administrators should audit and restrict custom role assignments to ensure no unintended users have task access without explicit task log access, and consider limiting network access to the Airflow API to trusted users only. After patching, review Airflow access logs to identify any unauthorized log access that may have occurred on affected versions (GitHub PR, Openwall).

The vulnerability was disclosed with a severity rating of "low" by the Apache Airflow security team on the oss-security mailing list, reflecting its limited exploitability and scope. A brief mention appeared on Bluesky's infosec community feed shortly after disclosure. Qualys added detection for this CVE (detection ID 530929) in their February 2026 application security detections update, and a technical write-up was published by Infinitsec covering the permission bypass mechanism (Openwall, Feedly).