CVE-2026-68969
Received Received - Intake

Cleartext Credential Exposure in Apache Airflow Audit Logs

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Apache Software Foundation

Description
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-68969
EUVD
EUVD-2026-57270

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache airflow From 3.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Airflow versions before 3.3.1 had a flaw where sensitive data like Variable values and Connection extra contents were logged in cleartext when submitted via bulk endpoints. The audit log masking only checked top-level fields, missing nested entities in bulk requests, exposing secrets to any authenticated user with audit-log read access.

Detection Guidance

Check Apache Airflow audit logs for plaintext secrets in bulk endpoint entries. Look for nested 'actions[].entities[]' structures with 'val'/'value' or 'extra' fields in PATCH /api/v2/variables and PATCH /api/v2/connections requests.

Impact Analysis

Attackers with audit-log access could recover secrets like passwords or API keys stored in Variables or Connections. Even operators importing variables via the UI could unintentionally expose all secrets in the log file. Deployments upgraded for CVE-2026-50204 remain vulnerable as this is a separate issue.

Compliance Impact

This vulnerability likely violates compliance requirements for protecting sensitive data such as GDPR's data protection principles or HIPAA's safeguards for protected health information, as it exposes unencrypted secrets in logs accessible to unauthorized users.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.1 or later to apply the fix for CVE-2026-68969. This addresses improper masking of nested sensitive data in bulk audit logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68969. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart