CVE-2026-59244

UNKNOWN 0.0

Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

CWE	CWE-312
Vendor	apache software foundation
Product	apache airflow
Published	Aug 12, 2026
Last Updated	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow

0 < 3.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/68975 lists.apache.org: https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6 openwall.com: http://www.openwall.com/lists/oss-security/2026/08/12/7

Credits

Juan Pablo Guereca (@jpgerek) Juan Pablo Guereca (@jpgerek)