Apache Airflow: Airflow externalLogUrl Permission Bypass

Vulnerability

Details

CVE-2026-22922 is an authorization flaw in Apache Airflow versions 3.1.0 through 3.1.6. The root cause is an incorrect access control check that permits an authenticated user with custom permissions limited to task access to view task logs without having explicit task log access [2]. This bypasses the intended permission model where task log access should be a separate privilege.

Exploitation

An attacker must be an authenticated user in Airflow with custom permissions that grant task access (e.g., the ability to run or view tasks). No additional authentication bypass is required; the flaw lies in how the system evaluates permissions when serving task logs [2]. The attack surface is the Airflow web interface or API endpoints that expose task logs.

Impact

Successful exploitation allows the attacker to read task logs that they are not authorized to see. Task logs may contain sensitive information such as credentials, API keys, or business data, leading to information disclosure and potential lateral movement within the environment [2].

Mitigation

The issue is fixed in Apache Airflow 3.1.7 [2]. The fix was implemented in pull request #60412, which corrected the access control logic for external log URLs [3]. Users are strongly advised to upgrade to version 3.1.7 or later. No workarounds have been provided.