UNKNOWN NVD
CVE-2026-59244
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstanc
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
References
- https://github.com/apache/airflow/pull/68975
- https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6
- https://www.openwall.com/lists/oss-security/2026/08/12/7
This unknown severity vulnerability was published on 2026-08-12 via NVD.
vulnfeed aggregates 10467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.