CVE-2026-68970

Analyzed Analyzed - Analysis Complete

Variable List Deserialization Disclosure in Apache Airflow

Publication date: 2026-08-12

Last updated on: 2026-08-14

Assigner: Apache Software Foundation

Description

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-14

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68970

EUVD

EUVD-2026-57269

Affected Vendors & Products

Vendor	Product	Version / Range
apache	airflow	to 3.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

Apache Airflow's Task SDK failed to mask secrets stored in Variable values when those values were JSON lists. This meant sensitive data like credentials or region names appeared in cleartext in task logs and the Rendered Templates UI. The masking function only handled strings and dictionaries, leaving lists unprocessed.

Detection Guidance

Check Apache Airflow task logs and Rendered Templates UI for any unmasked secrets stored in Variables with list-shaped JSON values. Look for exposed credentials or sensitive data in plaintext within these sections.

Impact Analysis

Any authenticated user with access to task logs or rendered templates could recover exposed secrets. This includes users who can read logs or view the UI, requiring no special configuration. The impact is similar to CVE-2026-59244 but specifically affects list-shaped Variable values.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be impacted if secrets like credentials or personal data are leaked through logs or UI.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.1 or later to apply the fix for list-shaped Variable masking. Review and re-mask any Variables with list-shaped JSON values that may have been exposed previously.

Hi! I’m here to help you understand CVE-2026-68970. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70