Advisoriesby IbisApache AirflowGHSA-w9r4-94fj-xp69
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Fix: upgrade to 3.2.0 or later
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case the variables were retrieved by the user the secrets stored as nested fields were not masked.
If developers do not store variables with sensitive values in JSON form, their projects are not affected. Otherwise upgrade to the fixed version, Apache Airflow 3.2.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 3.0.0, < 3.2.0 | 3.2.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-668
- Also known as
- BIT-airflow-2026-32690, CVE-2026-32690, PYSEC-2026-19, PYSEC-2026-2362
More Apache Airflow advisories
All Apache Airflow
In case of SQL errorsCVE-2026-30912fixed in 3.2.0Apache Airflow: code executionCVE-2026-25917fixed in 3.2.0Apache Airflow: JWT token appearing in logsCVE-2026-31987fixed in 3.2.0Apache Airflow: RCE by race condition in example_xcom dagCVE-2025-54550fixed in 3.2.0Apache Airflow: information disclosureCVE-2026-25219fixed in 3.1.8Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APICVE-2026-33858fixed in 3.2.0