CVE-2026-59244

Katalog CVE

CVSS 6.5 · Medium EPSS 0,23%

Kerentanan Cleartext Storage of Sensitive Information pada apache airflow. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

16 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-312: Cleartext Storage of Sensitive Information

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6 mailing list · advisory vendor
• https://github.com/apache/airflow/pull/68975 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/08/12/7 mailing list · advisory pihak ketiga