IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-04-16 14:16

MODIFIED

2026-04-16 14:16

EPSS (Prob. Exploit)

0.84%

Top 42.6%

DATA SOURCES:

NVD 🔗 2026-04-16 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-29

> DESCRIPTION

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-532

> CWE DETAILED DESCRIPTIONS

CWE-532: Insertion of Sensitive Information into Log File - The product writes sensitive information to a log file.

> GITHUB SECURITY ADVISORY

GHSA-phv5-vq5p-qhp7 MODERATE

Apache Airflow: JWT token appearing in logs

AFFECTED PACKAGES:

PIP / apache-airflow

>= 3.0.0, < 3.2.0

Fixed in: 3.2.0

> HISTORIQUE DES MODIFICATIONS

Première apparition

16/04/2026 14:16

Source: NVD

📊 ENRICHISSEMENT 01/05/2026 06:01

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-532: Insertion of Sensitive Information into Log File - The product writes sensitive information to a log file.

Total des modifications: 1 Dernière mise à jour: 6 months ago

> REFERENCES

https://github.com/apache/airflow/issues/62428

https://github.com/apache/airflow/issues/62773

https://github.com/apache/airflow/pull/62964

https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g