CVE-2026-32690CWE-668

Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

Low · published April 18, 2026

CVSS v3.1
3.7
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.

If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00657 · 50.8th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-04-18T06:22Z
EPSS history
Timeline
  • 18 APR 06:22Z
    Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1
    cvelistv5