Vulnerability · Published Aug 12, 2026 · Assigned by apache
CVE-2026-59244Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI
Medium 6.5
In plain English
A medium-severity security flaw in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow | 3.3.1 | GHSA-f643-3rc2-j27w |
| PyPI | apache-airflow | 3.3.1 | PYSEC-2026-3706 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 – before 3.0.0 |
| Apache Software Foundation | Apache Airflow | 3.0.0 – before 3.3.1 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N