CVE-2026-31987

HighCVSS 7.5/10Last modified Nov 3, 2026

Description

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	>= 3.0.0, < 3.2.0

References

https://github.com/apache/airflow/issues/62428Issue Tracking
https://github.com/apache/airflow/issues/62773Issue Tracking
https://github.com/apache/airflow/pull/62964Issue Tracking, Patch, Third Party Advisory
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6gMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/16/7Mailing List, Third Party Advisory

Timeline

Published: Apr 16, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-319885.3yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field pars CVE-2026-319896.3OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses CVE-2026-31998.8A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacke CVE-2026-319907.1OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination syml CVE-2026-319914.6OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts s CVE-2026-319928.8OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators CVE-2026-319936.4OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticate CVE-2026-319947.8OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsa CVE-2026-319957.0OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback m CVE-2026-319964.4OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute CVE-2026-319976.7OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-CVE-2026-319988.6OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy s