CVE-2026-59244

Modified Modified - Updated After Analysis

Apache Airflow secrets masker exposes dict Variable values in Rendered Templates

Publication date: 2026-08-12

Last updated on: 2026-08-18

Assigner: Apache Software Foundation

Description

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-18

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-59244

EUVD

EUVD-2026-57316

Affected Vendors & Products

Vendor	Product	Version / Range
apache	airflow	to 3.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

Apache Airflow's secrets masker failed to mask JSON Variable values when accessed via `var.json` in the Rendered Templates UI. The masking logic incorrectly checked if values were strings using `isinstance(str)`, so dict-type secrets were not masked and displayed in cleartext to users with access to the Rendered Templates view.

Detection Guidance

Check Apache Airflow logs for unmasked secrets in Rendered Templates UI. Look for tasks using var.json with JSON variables. Verify if secrets appear in plaintext in rendered_task_instance_fields table.

Impact Analysis

This vulnerability allows unauthorized users with access to the Rendered Templates view to view sensitive secrets stored as JSON Variables in plaintext. This could lead to data breaches, unauthorized access to systems, or exposure of confidential information.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR and HIPAA by exposing sensitive personal or health data in cleartext. Organizations may face legal penalties, loss of trust, and increased scrutiny for failing to protect confidential information.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.1 or later. Review and mask all JSON variables used in templates. Audit Rendered Templates UI for exposed secrets.

Hi! I’m here to help you understand CVE-2026-59244. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70