MEDIUMVulnerability
CVE-2026-59244
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
Properties
- severity
- MEDIUM
- score
- 6.5
- cve_id
- CVE-2026-59244
- vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- published_at
- 2026-08-12T16:17:09.197
- last_modified
- 2026-08-18T20:17:19.530
Related Entities (3)
DESCRIBED_BY (1)
→[Source]NVD
AFFECTS_PRODUCT (1)
→[Product]
HAS_WEAKNESS (1)
→[Weakness]Cleartext Storage of Sensitive Information
Explore deeper with Ninja Signal's threat intelligence graph