CVE-2026-59244

MediumCVSS 6.5/10Last modified Nov 3, 2026

Description

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	< 3.0.0
Apache Software Foundation	Apache Airflow	>= 3.0.0, < 3.3.1

References

https://github.com/apache/airflow/pull/68975Issue Tracking, Patch
https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/12/7Mailing List, Third Party Advisory

Timeline

Published: Aug 12, 2026
Last modified: Nov 3, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-592458.1In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced b CVE-2026-592466.3Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host CVE-2026-592477.6Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package con CVE-2026-592488.7Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust m CVE-2026-592496.3Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to CVE-2026-592508.3Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memo CVE-2026-592517.5Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to caus CVE-2026-592528.2Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, res CVE-2026-592535.0n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other proj CVE-2026-592546.3n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressi CVE-2026-592557.1BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that all CVE-2026-592567.5WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user i