CVE-2026-32690

LowCVSS 3.7/10Last modified Nov 3, 2026

Description

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.

If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	>= 3.0.0, < 3.2.0

References

https://github.com/apache/airflow/pull/63480Issue Tracking
https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/17/6Mailing List, Third Party Advisory

Timeline

Published: Apr 18, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-326915.3A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim owner CVE-2026-326926.5An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authentic CVE-2026-326938.8In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to CVE-2026-326946.6In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusiv CVE-2026-326957.7Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules CVE-2026-326967.5NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authenti CVE-2026-326976.5SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `Reco CVE-2026-326987.2OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to CVE-2026-326995.3FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the n CVE-2026-32708.8A vulnerability has been found in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-probe-core/src/main/java CVE-2026-327005.3Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allo CVE-2026-327017.5Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during