CVE-2026-32690lowCWE-668

CVE-2026-32690: fallo de gravedad baja en Apache Airflow

Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Airflow+ Monitorear apache-airflow

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.7epss 0.4%
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Apache Software Foundation · Apache Airflow
CVEs relacionadas — Apache Airflow

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-11978HIGHCVE-2020-11978EPSS 99.2%KEVCVE-2022-40127HIGHApache Airflow <2.4.0 has an RCE in a bash exampleEPSS 85.7%CVE-2022-45402MEDIUMApache Airflow: Open redirect during loginEPSS 81.8%CVE-2021-38540—Apache Airflow: Variable Import endpoint missed authentication checkEPSS 80.9%CVE-2022-24288—Apache Airflow: RCE in example DAGsEPSS 78.4%CVE-2020-11981—CVE-2020-11981EPSS 36.8%