PUBLISHED
2026-08-12 16:17
MODIFIED
2026-08-12 16:17
EPSS (Prob. Exploit)
0.23%
Top 86.1%
> DESCRIPTION
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-312: Cleartext Storage of Sensitive Information - The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
> GITHUB SECURITY ADVISORY
GHSA-f643-3rc2-j27w
MODERATE
Apache Airflow exposes dict-valued var.json secrets in Rendered Templates
AFFECTED PACKAGES:
PIP / apache-airflow
< 3.3.1
Fixed in: 3.3.1
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI
AFFECTED PACKAGES:
Unknown / Unknown
8963 versions affected
ALIASES:
BIT-airflow-2026-59244, GHSA-f643-3rc2-j27w, PYSEC-2026-3706
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/08/2026 16:17
Source: NVD
📊
ENRICHISSEMENT
01/09/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-312: Cleartext Storage of Sensitive Information - The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Total des modifications: 1
Dernière mise à jour: 2 months ago