Database/Control plane, storage & DevOps

Airflow Task SDK: Variables whose JSON value is a list are not masked in task logs or rendered templates

CVSS 6.5CVE-2026-68970Control plane, storage & DevOpscurated

Impact

Masking is applied only when a deserialized Variable is a string or a dict; a top-level JSON list matches neither and is emitted unmasked. Secrets stored in that shape appear in cleartext in task logs and in the Rendered Templates view, so anyone who can read the logs of a task referencing such a Variable recovers the values - log readers are usually a much wider group than secrets readers. This is the list-shaped counterpart of CVE-2026-59244, which fixed only the dict case, so deployments that upgraded for that advisory remain affected.

Who can reach it

Any authenticated user able to read task logs or rendered templates for a task that references a list-valued Variable. No special configuration required.

What to do

Upgrade apache-airflow to 3.3.1 or later and restart schedulers and workers so the new Task SDK is in use. Also purge or restrict the historical task logs that already contain the values, and rotate anything they exposed.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-68970 https://github.com/apache/airflow/pull/70891 https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28 https://www.cve.org/CVERecord?id=CVE-2026-59244

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.