EUVD-2026-23233
GHSA-phv5-vq5p-qhp7
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 3 pypi packages depend on apache-airflow (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.0.0.
DescriptionNVD
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
AnalysisAI
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI user with log access to escalate privileges and impersonate DAG Authors. CVSS rates this 7.5 HIGH for confidentiality impact, though the EPSS score of 0.02% (5th percentile) suggests minimal observed exploitation attempts. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Apache Airflow deployments and identify instances running versions 3.0.0-3.1.x; restrict log file access to essential administrators only. Within 7 days: Apply vendor-released patch to upgrade to Apache Airflow 3.2.0 or later on all affected systems. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today