[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4bdbd943-e2cf-a927-40ab-7a4be6c01287@apache.org>
Date: Fri, 17 Apr 2026 10:24:10 +0000
From: Rahul Vats <rahulvats@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-32690: Apache Airflow: 3.x - Nested Variable Secret
Values Bypass Redaction via max_depth=1
Severity: low
Affected versions:
- Apache Airflow (apache-airflow) 3.0.0 before 3.2.0
Description:
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.
If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented
Credit:
Nguyen Anh Binh [IA Lab – FPT University] (finder)
Kevin Yang (remediation developer)
References:
https://github.com/apache/airflow/pull/63480
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-32690
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
