https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:25:11 +0000 https://cve.radiocsirt.org/vuln/bit-airflow-2026-22922 <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.</p> <p>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.</p> <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.</p> <p>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.</p> https://cve.radiocsirt.org/vuln/bit-airflow-2026-22922 https://cve.radiocsirt.org/vuln/euvd-2026-267713 EUVD-2026-267713 https://cve.radiocsirt.org/vuln/euvd-2026-267713 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22922 <p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.</p> <p>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.</p> <p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.</p> <p>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22922 https://cve.radiocsirt.org/vuln/ghsa-pm44-x5x7-24c4 <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>## Vulnerability Overview</p> <p>An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.</p> <p>## The Flaw</p> <p>The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate &#34;Task&#34; access (viewing the task state) from &#34;Task Log&#34; access (viewing the console output/logs).</p> <p>In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs.</p> <p>## Impact</p> <p>- **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles.</p> <p>## Affected Versions</p> <p>- Apache Airflow 3.1.0 through 3.1.6</p> <p>## Patches</p> <p>Users should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.</p> <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>## Vulnerability Overview</p> <p>An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.</p> <p>## The Flaw</p> <p>The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate &#34;Task&#34; access (viewing the task state) from &#34;Task Log&#34; access (viewing the console output/logs).</p> <p>In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs.</p> <p>## Impact</p> <p>- **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles.</p> <p>## Affected Versions</p> <p>- Apache Airflow 3.1.0 through 3.1.6</p> <p>## Patches</p> <p>Users should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.</p> https://cve.radiocsirt.org/vuln/ghsa-pm44-x5x7-24c4 https://cve.radiocsirt.org/vuln/pysec-2026-11 <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.</p> <p>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.</p> <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.</p> <p>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-11