CVE-2026-32690

Katalog CVE

CVSS 3.7 · Low EPSS 0,66%

Kerentanan Exposure of Resource to Wrong Sphere pada apache airflow. Skor CVSS 3.1 3.7 (Low) menurut CISA ADP.

Deskripsi (NVD)

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

Rincian

Terbit di NVD

18 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/17/6 mailing list · advisory pihak ketiga
• https://github.com/apache/airflow/pull/63480 issue tracking