CVE-2026-59244

🔶 medium

Summary

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

CVSS Score

6.5

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-08-12

First Seen: 2026-08-13

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 365,987 vulnerabilities in our database.

#195,533

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 18, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Juan Pablo Guereca (@jpgerek) Juan Pablo Guereca (@jpgerek) (remediation developer)

SSVC data provided by CISA

Last Modified 2026-09-16

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-312

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
apache	airflow	Affected	< 3.3.1

🔗 References 3

https://github.com/apache/airflow/pull/68975

Issue Tracking Patch

https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9...

Mailing List Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/08/12/7

Mailing List Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-75158	🔶 medium	4.3	0.6	Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting ...	2026-09-21
CVE-2026-82355	🔶 medium	4.2	0.7	When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airf...	2026-09-21
CVE-2026-86473	⛔ critical	9.1	0.8	Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client ...	2026-09-21
CVE-2026-54183	🔶 medium	4.3	0.5	Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The mas...	2026-08-12
CVE-2026-58076	⚠️ high	8.8	0.5	Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken fr...	2026-08-12
CVE-2026-59242	🔶 medium	5.4	0.6	Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload th...	2026-08-12

These CVEs affect the same products