CVE-2026-59244
mediumPriorität · verfolgen · 26OT-Risiko · erhöhtEPSS 0.002 · 14. PerzentilDEEUUSEPSS · bewertet 2026-10-27
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-2823Apache Airflow: Mehrere SchwachstellenDeutsch2026-08-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
- GHSA-f643-3rc2-j27wApache Airflow exposes dict-valued var.json secrets in Rendered Templates2026-08-12ghsa · osvUS
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
- BIT-airflow-2026-59244Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI2026-08-17vendor · osvUS
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
- PYSEC-2026-37062026-08-12vendor · osvUS
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2026/08/12/7cnnvd
- https://github.com/apache/airflow/pull/68975cnnvd
- https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6cnnvd
- https://github.com/apache/airflow/pull/68975enisa_euvd
- https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6enisa_euvd
- http://www.openwall.com/lists/oss-security/2026/08/12/7Mailing ListThird Party Advisorynvd
- https://github.com/apache/airflow/pull/68975Issue TrackingPatchnvd
- https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6Mailing ListVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan