Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.
If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented
References
| Link | Resource |
|---|---|
| https://github.com/apache/airflow/pull/63480 | Issue Tracking |
| https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5 | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/17/6 | Mailing List Third Party Advisory |
Configurations
History
17 Jun 2026, 10:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5 - Mailing List, Vendor Advisory |
21 Apr 2026, 14:41
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache airflow
Apache |
|
| References | () https://github.com/apache/airflow/pull/63480 - Issue Tracking | |
| References | () https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5 - Vendor Advisory, Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2026/04/17/6 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* |
20 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.7 |
18 Apr 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-18 07:16
Updated : 2026-06-17 10:36
NVD link : CVE-2026-32690
Mitre link : CVE-2026-32690
CVE.ORG link : CVE-2026-32690
JSON object : View
Products Affected
apache
- airflow
CWE
CWE-668
Exposure of Resource to Wrong Sphere