Vulnerability Description
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | >= 3.0.0, < 3.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/apache/airflow/pull/63480Issue Tracking
- https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5Vendor AdvisoryMailing List
- http://www.openwall.com/lists/oss-security/2026/04/17/6Mailing ListThird Party Advisory
FAQ
What is CVE-2026-32690?
CVE-2026-32690 is a vulnerability with a CVSS score of 3.7 (LOW). Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store...
How severe is CVE-2026-32690?
CVE-2026-32690 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32690?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.