CVE-2026-45426: Apache Airflow Log-Server JWT Validation Flaw Enables Cross-Dag Access

Technical summary

The vulnerability stems from misuse of Python's `str.lstrip()` during JWT token validation in Airflow's log server. The function strips any character from a set rather than matching a prefix, so validating a JWT with `sub` claim 'dag_a' against a requested path checks whether the path starts with any combination of {d, a, g, _}. This character-class matching rather than exact-prefix matching allows a worker with valid credentials for one Dag to enumerate and access logs from other Dags whose names happen to begin with overlapping characters. The flaw affects deployments where per-Dag log access scoping is relied upon for isolation, particularly multi-tenant, shared-executor, or shared-worker topologies.

Business impact

In multi-team or shared-executor environments, this flaw enables unauthorized information disclosure across Dag boundaries. Workers can read task output, error traces, and sensitive logs from other teams' or departments' Dags, potentially exposing credentials, data processing details, or business logic embedded in logs. While the vulnerability does not allow code execution or data modification, the breach of logical isolation undermines the security model for organizations that rely on Dag-level access control to enforce data compartmentalization.

Affected systems

Apache Airflow versions prior to 3.2.2 are affected. The vulnerability specifically impacts deployments using the log server with per-Dag JWT authorization, particularly those with multiple teams or users sharing workers. Single-tenant or tightly controlled single-team deployments have lower exposure, but any multi-user Airflow installation relying on per-Dag log isolation should be considered at risk.

Exploitability

Exploitation requires an attacker to already possess a valid, authenticated Airflow worker account with a Log-server JWT token issued for at least one Dag. The attacker cannot gain initial access via this flaw; they must have legitimate credentials. Given that prerequisite, discovering and reading logs from other Dags is trivial—character-class matching means no complex enumeration is needed, only requests to Dag names that share a character prefix. The CVSS score of 3.1 (LOW) reflects the requirement for prior authentication and the limited scope of impact (information disclosure only).

Remediation

Upgrade Apache Airflow to version 3.2.2 or later. The patch corrects the JWT validation logic to use proper prefix matching or exact string comparison instead of `str.lstrip()`. Organizations should test the upgrade in a non-production environment first, particularly those with custom authentication or log-server integrations. No configuration changes or workarounds are documented as substitutes for patching.

Patch guidance

Consult the official Apache Airflow release notes and security advisory for version 3.2.2 to verify compatibility with your deployment. Review any custom Dag naming conventions or access control overlays you may have implemented, as the fix may affect their behavior. Plan the upgrade during a maintenance window to account for potential worker restarts. If you are running a version substantially older than 3.2.2, consider whether intermediate patch versions exist and test accordingly.

Detection guidance

Monitor Airflow log-server access logs for requests from a single worker to multiple Dags whose names share character prefixes but are owned by different teams or users. Look for patterns such as a worker token issued for 'dag_a' accessing logs for 'aaaa_target', 'dag_attacker', '_dag_secret', etc. Examine worker JWT tokens and their `sub` claims to identify which Dags each token is authorized for, then cross-reference against actual log requests in access logs. Increased cross-Dag log enumeration by a single worker may indicate exploitation.

Why prioritize this

This vulnerability merits timely but not emergency patching. The CVSS score is LOW, exploitation requires pre-existing authentication, and impact is limited to log disclosure. However, in multi-team or regulated environments where per-Dag isolation is a documented security control, the breach of that control is material and should not be deferred indefinitely. Prioritize based on your reliance on Dag-level access scoping; single-tenant or air-gapped deployments can defer longer than shared-executor environments handling sensitive workloads.

Risk score, explained

The CVSS 3.1 score of 3.1 reflects a Low severity due to the required authenticated access (PR:L), high attack complexity in discovering the flawed behavior (AC:H), and limited impact scope—confidentiality is compromised (C:L) but integrity and availability are unaffected (I:N, A:N). The network-accessible attack vector (AV:N) partially offsets the access requirements. The low score appropriately captures that this is an information-disclosure issue within a trusted-user model rather than a critical system compromise.

Frequently asked questions