Publish Advisories

GHSA-5g2w-9f8g-g5q7
GHSA-pm44-x5x7-24c4
GHSA-5g2w-9f8g-g5q7
GHSA-pm44-x5x7-24c4

Author: advisory-database[bot]

advisories/github-reviewed/2026/02/GHSA-5g2w-9f8g-g5q7/GHSA-5g2w-9f8g-g5q7.json

@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5g2w-9f8g-g5q7",
+  "modified": "2026-02-11T21:39:40Z",
+  "published": "2026-02-09T12:30:22Z",
+  "aliases": [
+    "CVE-2026-24098"
+  ],
+  "summary": "Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users",
+  "details": "### Impact\n\n**Exposure of Sensitive Information:**\n\nAn information disclosure vulnerability exists in the Apache Airflow UI that allows authenticated users to view `Import Errors` for DAGs they are not authorized to access.\n\nIn affected versions, the **Import Errors** view does not correctly filter errors based on granular DAG permissions. This means a user with access to only `DAG_A` can view import errors generated by `DAG_B`, `DAG_C`, or system-level DAGs. These error logs often contain file paths, code snippets, or stack traces that reveal the internal structure and logic of restricted DAGs.\n\n### Patches\n\nUsers should upgrade to Apache Airflow **3.1.7** or later.\nThis version strictly enforces DAG-level permissions on the Import Errors view.\n\n### Workarounds\n\nThere are no known workarounds other than upgrading.\n\n### Resources\n\n* [CVE-2026-24098](https://nvd.nist.gov/vuln/detail/CVE-2026-24098)\n* [Pull Request #60801](https://github.com/apache/airflow/pull/60801)\n* [Mailing List Announcement](https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-airflow"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24098"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/airflow/pull/60801"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/airflow"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/02/09/3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-02-11T21:39:40Z",
+    "nvd_published_at": "2026-02-09T11:16:14Z"
+  }
+}

advisories/github-reviewed/2026/02/GHSA-pm44-x5x7-24c4/GHSA-pm44-x5x7-24c4.json

@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pm44-x5x7-24c4",
+  "modified": "2026-02-11T21:40:07Z",
+  "published": "2026-02-09T12:30:22Z",
+  "aliases": [
+    "CVE-2026-22922"
+  ],
+  "summary": "Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access",
+  "details": "## Vulnerability Overview\n\nAn authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions.\n\n## The Flaw\n\nThe vulnerability affects environments using custom roles or granular permission settings. Normally, Airflow allows administrators to separate \"Task\" access (viewing the task state) from \"Task Log\" access (viewing the console output/logs).\n\nIn affected versions, the permission check for retrieving logs is insufficient. An authenticated user who has been granted access to view Tasks can successfully request and view Task Logs, even if they do not have the specific `can_read` permission for Logs.\n\n## Impact\n\n- **Confidentiality Loss:** Task logs often contain sensitive operational data, debugging information, or potentially leaked secrets (environment variables, connection strings) that should not be visible to all users with basic task access.\n- **Broken Access Control:** This bypasses the intended security model for restricted user roles.\n\n## Affected Versions\n\n- Apache Airflow 3.1.0 through 3.1.6\n\n## Patches\n\nUsers should upgrade to Apache Airflow **3.1.7** or later, which enforces the correct permission checks for log access.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-airflow"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.1.0"
+            },
+            {
+              "fixed": "3.17.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22922"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/airflow/pull/60412"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/airflow"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-648"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-02-11T21:40:06Z",
+    "nvd_published_at": "2026-02-09T11:16:13Z"
+  }
+}