CVE-2026-68970: CWE-312: Cleartext Storage of Sensitive Information in Apache Software Foundation Apache Airflow
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
AI Analysis
Technical Summary
The vulnerability in Apache Airflow's Task SDK involves cleartext storage of sensitive information when the Variable's JSON value is a list. Masking was only applied to strings or dictionaries, leaving list-shaped secrets unmasked and exposed in task logs and the Rendered Templates UI. This flaw allows any authenticated user with read access to logs or templates to recover sensitive values. It is a variant of CVE-2026-59244, which only fixed the dict case. The issue persists in deployments that upgraded only for the previous fix. The recommended remediation is to upgrade to Apache Airflow version 3.3.1 or later.
Potential Impact
Sensitive information stored as list-shaped JSON Variables is exposed in cleartext in task logs and the Rendered Templates UI. This exposure allows any authenticated user with access to these logs or templates to retrieve secrets without additional privileges or configuration changes. This can lead to unauthorized disclosure of sensitive data within affected Apache Airflow deployments.
Mitigation Recommendations
Users should upgrade to Apache Airflow version 3.3.1 or later, which addresses this vulnerability by properly masking list-shaped JSON Variable values. There is no indication that temporary workarounds or configuration changes mitigate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the upgrade recommendation indicates an official fix is available in version 3.3.1.
CVE-2026-68970: CWE-312: Cleartext Storage of Sensitive Information in Apache Software Foundation Apache Airflow
Description
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Apache Airflow's Task SDK involves cleartext storage of sensitive information when the Variable's JSON value is a list. Masking was only applied to strings or dictionaries, leaving list-shaped secrets unmasked and exposed in task logs and the Rendered Templates UI. This flaw allows any authenticated user with read access to logs or templates to recover sensitive values. It is a variant of CVE-2026-59244, which only fixed the dict case. The issue persists in deployments that upgraded only for the previous fix. The recommended remediation is to upgrade to Apache Airflow version 3.3.1 or later.
Potential Impact
Sensitive information stored as list-shaped JSON Variables is exposed in cleartext in task logs and the Rendered Templates UI. This exposure allows any authenticated user with access to these logs or templates to retrieve secrets without additional privileges or configuration changes. This can lead to unauthorized disclosure of sensitive data within affected Apache Airflow deployments.
Mitigation Recommendations
Users should upgrade to Apache Airflow version 3.3.1 or later, which addresses this vulnerability by properly masking list-shaped JSON Variable values. There is no indication that temporary workarounds or configuration changes mitigate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the upgrade recommendation indicates an official fix is available in version 3.3.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-01T03:22:35.190Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c944ebf8831d539c07f70
Added to database: 08/12/2026, 15:42:06 UTC
Last enriched: 08/12/2026, 16:00:21 UTC
Last updated: 08/12/2026, 17:02:21 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.