CVE-2026-31987

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/issues/62428	Issue Tracking
https://github.com/apache/airflow/issues/62773	Issue Tracking
https://github.com/apache/airflow/pull/62964	Issue Tracking Patch Third Party Advisory
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/16/7	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Los tokens JWT utilizados por las tareas fueron expuestos en los registros. Esto podría permitir a los usuarios de la UI actuar como Autores de DAG. Se aconseja a los usuarios actualizar a una versión de Airflow que contenga la corrección. Se recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema.

Information

Published : 2026-04-16 14:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-31987

Mitre link : CVE-2026-31987

CVE.ORG link : CVE-2026-31987

JSON object : View

Products Affected

apache

airflow

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-31987", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31987", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-18T02:27:54.967201Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.2.0", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-04-16T14:16:13.490", "references": [{"url": "https://github.com/apache/airflow/issues/62428", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://github.com/apache/airflow/issues/62773", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://github.com/apache/airflow/pull/62964", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/16/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. \nUsers are advised to upgrade to Airflow version that contains fix.\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."}, {"lang": "es", "value": "Los tokens JWT utilizados por las tareas fueron expuestos en los registros. Esto podr\u00eda permitir a los usuarios de la UI actuar como Autores de DAG.\nSe aconseja a los usuarios actualizar a una versi\u00f3n de Airflow que contenga la correcci\u00f3n.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 3.2.0, que corrige este problema."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6", "versionEndExcluding": "3.2.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}