All vulnerabilities
CVE-2026-59244BIT-airflow-2026-59244GHSA-f643-3rc2-j27wPYSEC-2026-3706

apache-airflow: Apache Airflow exposes dict-valued var.json secrets in Rendered Templates

Apache Software Foundation apache-airflowpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.1Fixed versionGitHub
Published12 Aug 2026Updated 2 Oct 2026CVE List

What fixes it

  • 3.3.1apache-airflow, pipGitHub
  • 3.3.1Apache AirflowCVE List
  • 3.3.1apache-airflow, PyPIOSVpip install "apache-airflow>=3.3.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstance(str) guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

Text from CVE List

Affected versions 53

  • apache-airflow, pip< 3.3.1GitHub
  • Apache Airflowaffected: all versions before 3.3.1CVE List
  • apache-airflow, PyPIfrom first release, fixed in 3.3.1OSV
  • apache-airflow, PyPI1.10.0OSV
  • apache-airflow, PyPI1.10.1OSV
  • apache-airflow, PyPI1.10.10OSV
  • apache-airflow, PyPI1.10.10rc1OSV
  • apache-airflow, PyPI1.10.10rc2OSV
  • apache-airflow, PyPI1.10.10rc3OSV
  • apache-airflow, PyPI1.10.10rc4OSV
  • apache-airflow, PyPI1.10.10rc5OSV
  • apache-airflow, PyPI1.10.11OSV
  • apache-airflow, PyPI1.10.11rc1OSV
  • apache-airflow, PyPI1.10.11rc2OSV
  • apache-airflow, PyPI1.10.12OSV
  • apache-airflow, PyPI1.10.12rc1OSV
  • apache-airflow, PyPI1.10.12rc2OSV
  • apache-airflow, PyPI1.10.12rc3OSV
  • apache-airflow, PyPI1.10.12rc4OSV
  • apache-airflow, PyPI1.10.13OSV
  • apache-airflow, PyPI1.10.13rc1OSV
  • apache-airflow, PyPI1.10.14OSV
  • apache-airflow, PyPI1.10.14rc1OSV
  • apache-airflow, PyPI1.10.14rc2OSV
  • apache-airflow, PyPI1.10.14rc3OSV
  • apache-airflow, PyPI1.10.14rc4OSV
  • apache-airflow, PyPI1.10.15OSV
  • apache-airflow, PyPI1.10.15rc1OSV
  • apache-airflow, PyPI1.10.1b1OSV
  • apache-airflow, PyPI1.10.1rc2OSV
  • apache-airflow, PyPI1.10.2OSV
  • apache-airflow, PyPI1.10.2b2OSV
  • apache-airflow, PyPI1.10.2rc1OSV
  • apache-airflow, PyPI1.10.2rc2OSV
  • apache-airflow, PyPI1.10.2rc3OSV
  • apache-airflow, PyPI1.10.3OSV
  • apache-airflow, PyPI1.10.3b1OSV
  • apache-airflow, PyPI1.10.3b2OSV
  • apache-airflow, PyPI1.10.3rc1OSV
  • apache-airflow, PyPI1.10.3rc2OSV
  • apache-airflow, PyPI1.10.4OSV
  • apache-airflow, PyPI1.10.4b2OSV
  • apache-airflow, PyPI1.10.4rc1OSV
  • apache-airflow, PyPI1.10.4rc2OSV
  • apache-airflow, PyPI1.10.4rc3OSV
  • apache-airflow, PyPI1.10.4rc4OSV
  • apache-airflow, PyPI1.10.4rc5OSV
  • apache-airflow, PyPI1.10.5OSV
  • apache-airflow, PyPI1.10.5rc1OSV
  • apache-airflow, PyPI1.10.6OSV
  • apache-airflow, PyPI1.10.6rc1OSV
  • apache-airflow, PyPI1.10.6rc2OSV
  • apache-airflow, PyPI1.10.7OSV

References 9