## Vulnerability Overview An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions. ## The Flaw The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs). In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs. ## Impact - **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles. ## Affected Versions - Apache Airflow 3.1.0 through 3.1.6 ## Patches Users should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.
## Vulnerability Overview An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions. ## The Flaw The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs). In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs. ## Impact - **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles. ## Affected Versions - Apache Airflow 3.1.0 through 3.1.6 ## Patches Users should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.
Update apache-airflow to 3.1.7 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanApache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access affects apache-airflow (pip). Severity is medium. ## Vulnerability Overview An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions. ## The Flaw The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs). In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs. ## Impact - **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles. ## Affected Versions - Apache Airflow 3.1.0 through 3.1.6 ## Patches Users should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.
AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| apache-airflowpip | >=3.1.0,<3.1.7 | 3.1.7 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate apache-airflow to 3.1.7 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanApache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access affects apache-airflow (pip). Severity is medium. ## Vulnerability Overview An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions. ## The Flaw The vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate "Task" access (viewing the task state) from "Task Log" access (viewing the console output/logs). In affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs. ## Impact - **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access. - **Broken Access Control:** This bypasses the intended security model for restricted user roles. ## Affected Versions - Apache Airflow 3.1.0 through 3.1.6 ## Patches Users should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.
AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| apache-airflowpip | >=3.1.0,<3.1.7 | 3.1.7 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard