CVE-2026-31987CWE-532

Apache Airflow: JWT token appearing in logs

High · published April 16, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors.

Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00835 · 57.3th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-04-16T13:31Z
EPSS history
Timeline
  • 16 APR 13:31Z
    Apache Airflow: JWT token appearing in logs
    cvelistv5