CVE-2026-59244
Received Received - Intake

Apache Airflow secrets masker exposes dict Variable values in Rendered Templates

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Apache Software Foundation

Description
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-59244
EUVD
EUVD-2026-57316

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache airflow From 3.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Airflow's secrets masker failed to mask JSON Variable values when accessed via `var.json` in the Rendered Templates UI. The masking logic incorrectly checked if values were strings using `isinstance(str)`, so dict-type secrets were not masked and displayed in cleartext to users with access to the Rendered Templates view.

Detection Guidance

Check Apache Airflow logs for unmasked secrets in Rendered Templates UI. Look for tasks using var.json with JSON variables. Verify if secrets appear in plaintext in rendered_task_instance_fields table.

Impact Analysis

This vulnerability allows unauthorized users with access to the Rendered Templates view to view sensitive secrets stored as JSON Variables in plaintext. This could lead to data breaches, unauthorized access to systems, or exposure of confidential information.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR and HIPAA by exposing sensitive personal or health data in cleartext. Organizations may face legal penalties, loss of trust, and increased scrutiny for failing to protect confidential information.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.1 or later. Review and mask all JSON variables used in templates. Audit Rendered Templates UI for exposed secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59244. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart