EUVD-2026-57269
GHSA-f3c2-j7g8-vpp8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible via web UI with low complexity, but requires a low-privilege authenticated account; confidentiality impact is High due to exposure of stored secrets, with no integrity or availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2Blast Radius
ecosystem impact- 462 pypi packages depend on apache-airflow (429 direct, 37 indirect)
Ecosystem-wide dependent count for version 3.3.1.
DescriptionCVE.org
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
AnalysisAI
Cleartext exposure of list-shaped Variable secrets in Apache Airflow Task SDK (all versions before 3.3.1) allows any authenticated Airflow user to recover sensitive values directly from task execution logs and the Rendered Templates UI. The masking logic in _mask_and_deserialize_variable correctly handled string- and dict-typed JSON Variable values but contained no branch for the list type, so arrays - which may hold passwords, API tokens, or connection strings - were returned unredacted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Airflow user account with permission to read task execution logs or access the Rendered Templates UI for at least one task that dereferences a list-shaped Variable - meaning a Variable whose JSON value is a top-level array rather than a string, dict, or scalar. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate, elevated by the false-assurance problem: deployments that patched CVE-2026-59244 likely believe their masking is complete, yet remain fully exposed for list-shaped Variables. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary and only confirmed fix is to upgrade to apache-airflow 3.3.1 or later, as documented in the Apache advisory at https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28 and implemented in PR #70891 (https://github.com/apache/airflow/pull/70891). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today