CVE-2026-22922

MEDIUM

6.5

Descripcion

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Detalles CVE

Puntuacion CVSS v3.16.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado2/9/2026

Ultima modificacion2/11/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

apache:airflow

Debilidades (CWE)

CWE-648

Referencias

https://github.com/apache/airflow/pull/60412(security@apache.org)

https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40(security@apache.org)

http://www.openwall.com/lists/oss-security/2026/02/09/2(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.