Skip to content
fr Sign in
Not rated

CVE-2026-32690 Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by…

Description

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

Affected products and versions

Product Affected versions Fixed in
Apache Airflow 3.0 3.0.0 → < 3.2.0 3.2.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Airflow

The 153 CVEs of Apache Airflow →
CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie Not rated CVE-2026-75158 Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter… Not rated CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token,… Not rated CVE-2026-75157 Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of… Not rated
Track this CVE