What is the CVSS score of EUVD-2026-23233?

EUVD-2026-23233 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Airflow are affected by EUVD-2026-23233?

Apache Airflow versions 3.0.0 through 3.1.x inadvertently expose authentication tokens in application logs, enabling authenticated users with log access to impersonate DAG Authors and escalate…. A patch is available.

How to fix or mitigate EUVD-2026-23233?

Within 24 hours: Inventory all Apache Airflow deployments and identify instances running versions 3.0.0-3.1.x; restrict log file access to essential administrators only. Within 7 days: Apply vendor-released patch to upgrade to Apache Airflow 3.2.0 or later on all affected systems. Within 30 days: Audit logs for historical token exposure, rotate all JWT credentials, and implement log sanitization rules to prevent future credential leakage.

Apache Airflow EUVD-2026-23233

| CVE-2026-31987 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-04-16 apache

GHSA-phv5-vq5p-qhp7

Information Disclosure Apache Airflow

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 17:07 vuln.today

cvss_changed

Analysis Generated

Apr 18, 2026 - 04:22 vuln.today

CVSS changed

Apr 18, 2026 - 04:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 14:00 euvd

EUVD-2026-23233

Analysis Generated

Apr 16, 2026 - 14:00 vuln.today

Patch released

Apr 16, 2026 - 14:00 nvd

Patch available

CVE Published

Apr 16, 2026 - 13:31 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on apache-airflow (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

AnalysisAI

Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI user with log access to escalate privileges and impersonate DAG Authors. CVSS rates this 7.5 HIGH for confidentiality impact, though the EPSS score of 0.02% (5th percentile) suggests minimal observed exploitation attempts. No active exploitation is confirmed; vendor patch available in version 3.2.0 released April 2026.

Technical ContextAI

Apache Airflow is a workflow orchestration platform where users execute data pipelines (DAGs). The platform uses JWT tokens for task authentication, allowing task processes to authenticate back to the Airflow API. CWE-532 (Insertion of Sensitive Information into Log File) indicates these tokens were logged in plaintext, likely during task execution or API interactions. JWT tokens typically contain claims that identify the principal (user/service) and their permissions. In Airflow's role-based access model, DAG Authors have elevated privileges to create and modify workflows, while UI users may have restricted read-only access. Exposure of DAG Author tokens allows horizontal privilege escalation within the application. The vulnerability affects Apache Airflow versions 3.0.0 through all 3.1.x releases, as confirmed by CPE cpe:2.3:a:apache_software_foundation:apache_airflow and EUVD version ranges. The fix was implemented in GitHub PR #62964 and released in version 3.2.0.

RemediationAI

Upgrade to Apache Airflow 3.2.0 or later, which removes JWT token logging (fix implemented in GitHub PR https://github.com/apache/airflow/pull/62964). Refer to the official Apache advisory at https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g for upgrade guidance. For environments unable to immediately upgrade, implement compensating controls: restrict access to Airflow logs to only users who already possess DAG Author privileges (reducing the privilege escalation opportunity), enable log encryption at rest, configure log retention policies to minimize exposure window (delete logs containing tokens after archival requirements are met, noting this may impact forensic capabilities), and monitor for anomalous API calls using JWT tokens associated with logged-out or unexpected user sessions (implement JWT replay detection, though this adds operational overhead and may generate false positives during legitimate task retries). Review historical logs accessible to UI users and rotate credentials for any DAG Authors whose tokens may have been exposed. Note that log access restrictions may conflict with debugging workflows if developers require log visibility.