Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Airflow 3.1.7 Clear all filters
TI-2026-18407 CVE-2026-22922 · GHSA-pm44-x5x7-24c4

Apache Airflow: Airflow externalLogUrl Permission Bypass

Priority LOW 29

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00446 Published 2026-02-09 Fixed in 3.1.7 CWE-648
TI-2026-19422 CVE-2026-24098 · GHSA-5g2w-9f8g-g5q7

Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Priority LOW 30

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00777 Published 2026-02-09 Fixed in 3.1.7 CWE-200