CVE-2026-31987

Published: Apr 16, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Affected (1)

Products: Apache: Airflow

Apache

1 product

Airflow

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Airflow	From 3.0.0 to 3.2.0

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (5)

https://github.com/apache/airflow/issues/62428

Source: security@apache.org

Issue Tracking

https://github.com/apache/airflow/issues/62773

Source: security@apache.org

Issue Tracking

https://github.com/apache/airflow/pull/62964

Source: security@apache.org

Issue TrackingPatchThird Party Advisory

https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/04/16/7

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.