CVE-2026-68969: CWE-532: Insertion of Sensitive Information into Log File in Apache Software Foundation Apache Airflow
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
AI Analysis
Technical Summary
Apache Airflow improperly logs sensitive information in cleartext in audit logs when Variable values and Connection 'extra' fields are submitted through bulk PATCH API endpoints (/api/v2/variables and /api/v2/connections). The audit-log masking mechanism only masks top-level request fields and fails to mask nested entities two levels deep in bulk requests. Consequently, any authenticated user with audit-log read access can access these secrets verbatim from the logs, despite the connection table encrypting the 'extra' field. This vulnerability is separate from CVE-2026-50204, which fixed single-entity endpoints in version 3.3.0. Deployments upgraded only for that fix remain vulnerable and must upgrade to version 3.3.1 or later.
Potential Impact
Sensitive secrets such as Variable values and Connection 'extra' contents are exposed in cleartext within audit logs. This exposure allows any authenticated user with audit-log read access to retrieve sensitive information without requiring direct read permissions on Variables or Connections. The connection 'extra' data is stored unencrypted in logs despite being encrypted in the database, increasing the risk of secret leakage. This can lead to unauthorized disclosure of credentials or other confidential data managed by Apache Airflow.
Mitigation Recommendations
Users should upgrade Apache Airflow to version 3.3.1 or later, where this issue is fixed. The vulnerability affects bulk PATCH endpoints and is not mitigated by the previous fix in version 3.3.0. No other mitigations are indicated. Patch status is not explicitly stated in the input data, but the advisory recommends upgrading to 3.3.1 or later, implying an official fix is available in that version.
CVE-2026-68969: CWE-532: Insertion of Sensitive Information into Log File in Apache Software Foundation Apache Airflow
Description
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Airflow improperly logs sensitive information in cleartext in audit logs when Variable values and Connection 'extra' fields are submitted through bulk PATCH API endpoints (/api/v2/variables and /api/v2/connections). The audit-log masking mechanism only masks top-level request fields and fails to mask nested entities two levels deep in bulk requests. Consequently, any authenticated user with audit-log read access can access these secrets verbatim from the logs, despite the connection table encrypting the 'extra' field. This vulnerability is separate from CVE-2026-50204, which fixed single-entity endpoints in version 3.3.0. Deployments upgraded only for that fix remain vulnerable and must upgrade to version 3.3.1 or later.
Potential Impact
Sensitive secrets such as Variable values and Connection 'extra' contents are exposed in cleartext within audit logs. This exposure allows any authenticated user with audit-log read access to retrieve sensitive information without requiring direct read permissions on Variables or Connections. The connection 'extra' data is stored unencrypted in logs despite being encrypted in the database, increasing the risk of secret leakage. This can lead to unauthorized disclosure of credentials or other confidential data managed by Apache Airflow.
Mitigation Recommendations
Users should upgrade Apache Airflow to version 3.3.1 or later, where this issue is fixed. The vulnerability affects bulk PATCH endpoints and is not mitigated by the previous fix in version 3.3.0. No other mitigations are indicated. Patch status is not explicitly stated in the input data, but the advisory recommends upgrading to 3.3.1 or later, implying an official fix is available in that version.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-01T03:22:13.493Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c944ebf8831d539c07f69
Added to database: 08/12/2026, 15:42:06 UTC
Last enriched: 08/12/2026, 16:00:32 UTC
Last updated: 08/12/2026, 16:41:43 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.