CVE-2026-59244: CWE-312: Cleartext Storage of Sensitive Information in Apache Software Foundation Apache Airflow
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
AI Analysis
Technical Summary
Apache Airflow's secrets masker did not mask `var.json` Variable values when those values were dictionaries, due to a failed isinstance(str) check. As a result, secrets stored as JSON Variables and referenced via `var.json` in templates were displayed in cleartext in the Rendered Templates UI to any user with access to that task's view. This vulnerability is tracked as CVE-2026-59244 and classified under CWE-312 (Cleartext Storage of Sensitive Information). The issue is fixed in Apache Airflow 3.3.1, which masks nested Variable values regardless of their type.
Potential Impact
Sensitive information stored as JSON Variables in Apache Airflow prior to version 3.3.1 could be exposed in cleartext to any user with access to the Rendered Templates UI for the affected task. This exposure could lead to unauthorized disclosure of secrets or credentials managed within Airflow, potentially compromising security depending on the nature of the exposed data.
Mitigation Recommendations
Users should upgrade Apache Airflow to version 3.3.1 or later, where this issue is fixed by properly masking nested Variable values regardless of type. No other mitigation is indicated by the vendor advisory.
CVE-2026-59244: CWE-312: Cleartext Storage of Sensitive Information in Apache Software Foundation Apache Airflow
Description
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Airflow's secrets masker did not mask `var.json` Variable values when those values were dictionaries, due to a failed isinstance(str) check. As a result, secrets stored as JSON Variables and referenced via `var.json` in templates were displayed in cleartext in the Rendered Templates UI to any user with access to that task's view. This vulnerability is tracked as CVE-2026-59244 and classified under CWE-312 (Cleartext Storage of Sensitive Information). The issue is fixed in Apache Airflow 3.3.1, which masks nested Variable values regardless of their type.
Potential Impact
Sensitive information stored as JSON Variables in Apache Airflow prior to version 3.3.1 could be exposed in cleartext to any user with access to the Rendered Templates UI for the affected task. This exposure could lead to unauthorized disclosure of secrets or credentials managed within Airflow, potentially compromising security depending on the nature of the exposed data.
Mitigation Recommendations
Users should upgrade Apache Airflow to version 3.3.1 or later, where this issue is fixed by properly masking nested Variable values regardless of type. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-04T00:20:30.244Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c97cebf8831d539c533cf
Added to database: 08/12/2026, 15:57:02 UTC
Last enriched: 08/12/2026, 16:16:20 UTC
Last updated: 08/12/2026, 23:21:53 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.