Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-srr5-3rxv-rkg8
Vulnerability ID VCID-srr5-3rxv-rkg8
Aliases BIT-airflow-2026-22922
CVE-2026-22922
GHSA-pm44-x5x7-24c4
PYSEC-2026-11
Summary Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-648 Incorrect Use of Privileged APIs
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2026-22922
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2026-22922
cvssv3.1 6.5 https://github.com/advisories/GHSA-pm44-x5x7-24c4
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-pm44-x5x7-24c4
cvssv3.1 6.5 https://github.com/apache/airflow
generic_textual MODERATE https://github.com/apache/airflow
cvssv3.1 6.5 https://github.com/apache/airflow/pull/60412
generic_textual MODERATE https://github.com/apache/airflow/pull/60412
ssvc Track https://github.com/apache/airflow/pull/60412
cvssv3.1 6.5 https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-11.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-11.yaml
cvssv3.1 6.5 https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
generic_textual MODERATE https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
ssvc Track https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2026-22922
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-22922
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2026/02/09/2
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2026/02/09/2
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-22922
https://github.com/apache/airflow
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-11.yaml
http://www.openwall.com/lists/oss-security/2026/02/09/2
60412 https://github.com/apache/airflow/pull/60412
CVE-2026-22922 https://nvd.nist.gov/vuln/detail/CVE-2026-22922
gdb7vffhpmrj5hp1j0oj1j13o4vmsq40 https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
GHSA-pm44-x5x7-24c4 https://github.com/advisories/GHSA-pm44-x5x7-24c4
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/advisories/GHSA-pm44-x5x7-24c4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow/pull/60412
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-09T16:31:30Z/ Found at https://github.com/apache/airflow/pull/60412
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-11.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-09T16:31:30Z/ Found at https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-22922
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2026/02/09/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.15001
EPSS Score 0.00047
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:52:51.362949+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/22xxx/CVE-2026-22922.json 38.6.0