PUBLISHED
2026-04-18 07:16
MODIFIED
2026-04-18 07:16
EPSS (Prob. Exploit)
0.66%
Top 49.1%
> DESCRIPTION
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.
If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-668: Exposure of Resource to Wrong Sphere - The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
> GITHUB SECURITY ADVISORY
GHSA-w9r4-94fj-xp69
LOW
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.0.0, < 3.2.0
Fixed in: 3.2.0
PIP / apache-airflow-core
>= 3.0.0, < 3.2.0
Fixed in: 3.2.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1
ALIASES:
BIT-airflow-2026-32690, GHSA-w9r4-94fj-xp69, PYSEC-2026-19, PYSEC-2026-2362
> HISTORIQUE DES MODIFICATIONS
Première apparition
18/04/2026 07:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-668: Exposure of Resource to Wrong Sphere - The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Total des modifications: 1
Dernière mise à jour: 6 months ago