VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Aug 12, 2026· Updated Nov 3, 2026

CVE-2026-59244

CVE-2026-59244

Description

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstance(str) guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
apache-airflowPyPI
< 3.3.13.3.1

Affected products

3
  • Apache/Airflow2 versions
    cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*range: <3.3.1
    • (no CPE)range: >=3.3.1
  • osv-coords
    pkg:bitnami/airflow
    Range: < 3.3.1

Patches

Vulnerability mechanics

References

10

News mentions

1