CVE-2026-31987

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31987
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/airflow/issues/62428 Issue Tracking
https://github.com/apache/airflow/issues/62773 Issue Tracking
https://github.com/apache/airflow/pull/62964 Issue Tracking Third Party Advisory Patch
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/16/7 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
History

20 Apr 2026, 16:54

Type Values Removed Values Added
References () https://github.com/apache/airflow/issues/62428 - () https://github.com/apache/airflow/issues/62428 - Issue Tracking
References () https://github.com/apache/airflow/issues/62773 - () https://github.com/apache/airflow/issues/62773 - Issue Tracking
References () https://github.com/apache/airflow/pull/62964 - () https://github.com/apache/airflow/pull/62964 - Issue Tracking, Third Party Advisory, Patch
References () https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g - () https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/04/16/7 - () http://www.openwall.com/lists/oss-security/2026/04/16/7 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
First Time Apache airflow
Apache

18 Apr 2026, 04:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

16 Apr 2026, 19:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/04/16/7 -

16 Apr 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-16 14:16

Updated : 2026-04-20 16:54

NVD link : CVE-2026-31987

Mitre link : CVE-2026-31987

CVE.ORG link : CVE-2026-31987

JSON object : View

Products Affected

apache

  • airflow
CWE
CWE-532

Insertion of Sensitive Information into Log File