{"items":[{"id":"NVI-00018653","kind":"vulnerability","title":"Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pm44-x5x7-24c4","CVE-2026-22922"],"plain_summary":"GitHub lists this reviewed advisory for apache-airflow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4bcc184ff52d5d60dd15747c569543cb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-05T14:25:22.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4bcc184ff52d5d60dd15747c569543cb"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4bcc184ff52d5d60dd15747c569543cb","url":"https://github.com/advisories/GHSA-pm44-x5x7-24c4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pm44-x5x7-24c4","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:53:06.181Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4bcc184ff52d5d60dd15747c569543cb"],"technology":"apache-airflow","known_exclusions":[],"conditions_summary":"## Vulnerability Overview\n\nAn authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.\n\n## The Flaw\n\nThe vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate \"Task\" access (viewing the task state) from \"Task Log\" access (viewing the console output/logs).\n\nIn affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs.\n\n## Impact\n\n- **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access.\n- **Broken Access Control:** This bypasses the intended security model for restricted user roles.\n\n## Affected Versions\n\n- Apache Airflow 3.1.0 through 3.1.6\n\n## Patches\n\nUsers should upgrade to Apache Airflow **3.1.7** or later, which enforces th","public_affected_ranges":[">= 3.1.0, < 3.1.7"]}],"null_published_at":"2026-11-07T07:07:39.868Z","source_updated_at":"2026-06-05T14:25:22.000Z","source_disclosed_at":"2026-02-09T12:30:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:53:06.181Z"}],"next_cursor":null,"snapshot_revision":"42594"}