{"id":"CVE-2026-68970","aliases":["BIT-airflow-2026-68970","GHSA-f3c2-j7g8-vpp8","PYSEC-2026-3712"],"url":"https://o3.security/vulnerability/CVE-2026-68970","summary":"Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI","details":"Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.","published":"2026-08-12T15:24:53.217Z","modified":"2026-10-21T02:59:05.190581505Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"apache-airflow","fixedVersion":"3.3.1"}],"fix":{"url":"https://github.com/apache/airflow/pull/70891","label":"apache/airflow#70891"},"references":[{"type":"WEB","url":"https://pypi.python.org"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-59244"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68970.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68970"},{"type":"FIX","url":"https://github.com/apache/airflow/pull/70891"},{"type":"WEB","url":"https://github.com/apache/airflow/commit/0de18f5ea722fdb0f3372d02cf0222348e83ddcf"},{"type":"WEB","url":"https://github.com/apache/airflow/commit/c2e4711c6fd43f344f5940e37f813cb3aa49dbf1"},{"type":"PACKAGE","url":"https://github.com/apache/airflow"},{"type":"WEB","url":"https://github.com/apache/airflow/releases/tag/3.3.1"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-3712.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:59:05.190581505Z"}}