p PatchFirst

CVE-2026-32690

CVE-2026-32690 · Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

CVSS 3.7 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache airflow

    Versions
    • ≥ 3.0.0, < 3.2.0: Affected (semver)

    Update to 3.2.0

  • apache-airflow-core PyPI

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.1rc1
    • 3.0.2
    • 3.0.2rc1
    • 3.0.2rc2
    • 3.0.3
    • 3.0.3rc1
    • 3.0.3rc2
    • 3.0.3rc3
    • 3.0.3rc4
    • 3.0.3rc5
    • 3.0.3rc6
    • 3.0.4
    • 3.0.4rc1
    • 3.0.4rc2
    • 3.0.5
    • 3.0.5rc1
    • 3.0.5rc2
    • 3.0.5rc3
    • 3.0.6
    • 3.0.6rc1
    • 3.0.6rc2
    • 3.1.0
    • 3.1.0b1
    • 3.1.0b2
    • 3.1.0rc1
    • 3.1.0rc2
    • 3.1.1
    • 3.1.1rc1
    • 3.1.1rc2
    • 3.1.2
    • 3.1.2rc1
    • 3.1.2rc2
    • 3.1.3
    • 3.1.3rc1
    • 3.1.4
    • 3.1.4rc1
    • 3.1.4rc2
    • 3.1.5
    • 3.1.5rc1
    • 3.1.6
    • 3.1.6rc1
    • 3.1.7
    • 3.1.7rc1
    • 3.1.7rc2
    • 3.1.8
    • 3.1.8rc1
    • 3.1.8rc2
    • 3.2.0b1
    • 3.2.0b2
    • 3.2.0rc1
    • 3.2.0rc2
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.2.0

    Update to 3.2.0

  • apache-airflow PyPI

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.1rc1
    • 3.0.2
    • 3.0.2rc1
    • 3.0.2rc2
    • 3.0.3
    • 3.0.3rc1
    • 3.0.3rc2
    • 3.0.3rc3
    • 3.0.3rc4
    • 3.0.3rc5
    • 3.0.3rc6
    • 3.0.4
    • 3.0.4rc1
    • 3.0.4rc2
    • 3.0.5
    • 3.0.5rc1
    • 3.0.5rc2
    • 3.0.5rc3
    • 3.0.6
    • 3.0.6rc1
    • 3.0.6rc2
    • 3.1.0
    • 3.1.0b1
    • 3.1.0b2
    • 3.1.0rc1
    • 3.1.0rc2
    • 3.1.1
    • 3.1.1rc1
    • 3.1.1rc2
    • 3.1.2
    • 3.1.2rc1
    • 3.1.2rc2
    • 3.1.3
    • 3.1.3rc1
    • 3.1.4
    • 3.1.4rc1
    • 3.1.4rc2
    • 3.1.5
    • 3.1.5rc1
    • 3.1.6
    • 3.1.6rc1
    • 3.1.7
    • 3.1.7rc1
    • 3.1.7rc2
    • 3.1.8
    • 3.1.8rc1
    • 3.1.8rc2
    • 3.2.0b1
    • 3.2.0b2
    • 3.2.0rc1
    • 3.2.0rc2
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.2.0

    Update to 3.2.0

Original sources

Check your server →