NIXPKGS-2026-0209
GitHub issue
published on 10 Feb 2026
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
Apache Airflow: Airflow externalLogUrl Permission Bypass
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
Affected products
apache-airflow
- <3.1.7
Package maintainers
-
@bhipple Benjamin Hipple <bhipple@protonmail.com>
-
@gbpdt Graham Bennett <nix@pdtpartners.com>
-
@ingenieroariel Ariel Nunez <ariel@nunez.co>