Log Server JWT Vulnerability in Apache Airflow

CVE-2026-45426

What is CVE-2026-45426?

The vulnerability arises from a flaw in the authorization process of JWT tokens for Apache Airflow's Log server. When validating JWT's sub claim, the str.lstrip() method improperly handles path segments, leading to unauthorized log access. This flaw allows authenticated workers with valid tokens to potentially read logs from other DAGs sharing character-class prefixes with their DAG names. This could expose sensitive task outputs and error traces, compromising the per-DAG isolation and privacy expected in multi-team deployments. Users are urged to upgrade to Apache Airflow version 3.2.2 or later to mitigate this risk.

References