CVE-2026-59244

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/68975	Issue Tracking Patch
https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/12/7	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El enmascarador de secretos de Apache Airflow no enmascaró los valores de la Variable ’var.json’ cuyo valor es un diccionario en la interfaz de usuario de Plantillas Renderizadas - el valor del diccionario falló una comprobación ’isinstance(str)’ - por lo que un secreto almacenado como una Variable JSON y referenciado en una plantilla a través de ’var.json’ se mostró en texto claro a cualquier usuario con acceso a la vista de Plantillas Renderizadas de esa tarea. Se aconseja a los usuarios actualizar a apache-airflow 3.3.1 o posterior, que enmascara los valores de Variables anidadas independientemente del tipo.

Information

Published : 2026-08-12 16:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-59244

Mitre link : CVE-2026-59244

CVE.ORG link : CVE-2026-59244

JSON object : View

Products Affected

apache

airflow

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2026-59244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59244", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T13:43:56.777503Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.1", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow", "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-08-12T16:17:09.197", "references": [{"url": "https://github.com/apache/airflow/pull/68975", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/12/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI \u2014 the dict value failed an `isinstance(str)` guard \u2014 so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type."}, {"lang": "es", "value": "El enmascarador de secretos de Apache Airflow no enmascar\u00f3 los valores de la Variable \u2019var.json\u2019 cuyo valor es un diccionario en la interfaz de usuario de Plantillas Renderizadas - el valor del diccionario fall\u00f3 una comprobaci\u00f3n \u2019isinstance(str)\u2019 - por lo que un secreto almacenado como una Variable JSON y referenciado en una plantilla a trav\u00e9s de \u2019var.json\u2019 se mostr\u00f3 en texto claro a cualquier usuario con acceso a la vista de Plantillas Renderizadas de esa tarea. Se aconseja a los usuarios actualizar a apache-airflow 3.3.1 o posterior, que enmascara los valores de Variables anidadas independientemente del tipo."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDF5E090-3549-452E-BB3A-741DCE15078E", "versionEndExcluding": "3.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}