AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache AirflowGHSA-phv5-vq5p-qhp7

Apache Airflow: JWT token appearing in logs

Apache Airflow

CVE-2026-31987 · Published Apr 16, 2026 · updated Jul 13, 2026

Medium7.5
Fix: upgrade to 3.2.0 or later
GitHub advisory

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors.

Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
>= 3.0.0, < 3.2.03.2.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-532
Also known as
BIT-airflow-2026-31987, CVE-2026-31987, PYSEC-2026-2352

More Apache Airflow advisories

All Apache Airflow
Low 3.7Apr 18Apache Airflow Exposes Secrets in Variables Saved as JSON DictionariesCVE-2026-32690fixed in 3.2.0High 7.5Apr 18In case of SQL errorsCVE-2026-30912fixed in 3.2.0High 7.2Apr 18Apache Airflow: code executionCVE-2026-25917fixed in 3.2.0High 8.1Apr 16Apache Airflow: RCE by race condition in example_xcom dagCVE-2025-54550fixed in 3.2.0Medium 6.5Apr 15Apache Airflow: information disclosureCVE-2026-25219fixed in 3.1.8High 8.8Apr 13Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APICVE-2026-33858fixed in 3.2.0