CVE-2026-31987
Apache Airflow: JWT token appearing in logs
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.
| CWE | CWE-532 |
| Vendor | apache software foundation |
| Product | apache airflow |
| Published | Apr 16, 2026 |
| Last Updated | Apr 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache airflow
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Airflow
3.0.0 < 3.2.0
References
github.com: https://github.com/apache/airflow/pull/62964 github.com: https://github.com/apache/airflow/issues/62428 github.com: https://github.com/apache/airflow/issues/62773 lists.apache.org: https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g openwall.com: http://www.openwall.com/lists/oss-security/2026/04/16/7
Credits
unixengineer Jason Imison Pineapple