PUBLISHED
2026-02-09 11:16
MODIFIED
2026-02-09 11:16
EPSS (Prob. Exploit)
0.44%
Top 62.8%
> DESCRIPTION
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.
Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-648: Incorrect Use of Privileged APIs - The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
> GITHUB SECURITY ADVISORY
GHSA-pm44-x5x7-24c4
MODERATE
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.1.0, < 3.1.7
Fixed in: 3.1.7
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
ALIASES:
BIT-airflow-2026-22922, GHSA-pm44-x5x7-24c4
> HISTORIQUE DES MODIFICATIONS
Première apparition
09/02/2026 11:16
Source: NVD
📊
ENRICHISSEMENT
01/03/2026 06:46
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-648: Incorrect Use of Privileged APIs - The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by ca...
Total des modifications: 1
Dernière mise à jour: 8 months ago