CVE-2026-32690
Improper Secret Redaction in Apache Airflow JSON Variables
Publication date: 2026-04-18
Last updated on: 2026-04-21
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | airflow | From 3.0.0 (inc) to 3.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-668 | The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves secrets stored in variables as JSON dictionaries not being properly redacted. Specifically, when these variables are retrieved by a user, the secrets stored as nested fields within the JSON were not masked, potentially exposing sensitive information.
How can this vulnerability impact me? :
If you store sensitive values in variables using JSON format, this vulnerability could lead to exposure of those secrets when the variables are accessed, as the nested secret fields are not masked. This could result in unauthorized disclosure of sensitive information.
If you do not store variables with sensitive values in JSON form, you are not affected by this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
If you do not store variables with sensitive values in JSON form, you are not affected.
Otherwise, please upgrade to Apache Airflow 3.2.0 which contains the fix for this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves secrets stored in JSON variables not being properly redacted, which means sensitive information could be exposed if those variables are retrieved by users.
Exposure of sensitive data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require proper handling and protection of sensitive information.
Therefore, if sensitive data is stored in JSON variables in Apache Airflow versions prior to 3.2.0, this vulnerability could result in violations of these standards due to inadequate masking of secrets.
Upgrading to Apache Airflow 3.2.0, where the fix is implemented, is recommended to maintain compliance.