Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-31987: Airflow: Exposed Tokens Allow UI Users to Act as Dag Authors
CVE-2026-31987 · published 6 months ago
Summary
Airflow's task logs revealed sensitive information, potentially allowing unauthorized users to create workflows as if they were administrators. This could lead to data breaches or unauthorized changes. To fix this, update to the latest version of Airflow.
What to do
- Update apache software foundation apache-airflow to version 3.2.0.
- Update airflow to version 3.2.0.
- Update apache airflow to version 3.2.0 or later.
- Update apache software foundation apache airflow to version 3.2.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | apache software foundation | apache-airflow |
>= 3.0.0, < 3.2.0 Fix: upgrade to 3.2.0
|
| Bitnami | – | airflow |
>= 3.0.0, < 3.2.0 Fix: upgrade to 3.2.0
|
| – | apache | airflow |
>= 3.0.0, < 3.2.0 cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* |
| – | apache software foundation | apache airflow | < 3.2.0 |
Original advisory text
Apache Airflow: JWT token appearing in logs
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors.
Users are advised to upgrade to Airflow version that contains fix.
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
Users are advised to upgrade to Airflow version that contains fix.
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
References
- https://github.com/advisories/GHSA-phv5-vq5p-qhp7
- https://nvd.nist.gov/vuln/detail/CVE-2026-31987 Vendor Advisory
- https://pypi.python.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31987... Vendor Advisory
- https://github.com/apache/airflow/issues/62428 issue-tracking
- https://github.com/apache/airflow/issues/62773 issue-tracking
- https://github.com/apache/airflow/pull/62964 patch
- https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/04/16/7 Mailing List Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
6.9
Medium
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published16 Apr 2026
Updated4 Nov 2026
First seen16 Apr 2026
Sources
CVE-2026-31987 · NVD
GHSA-phv5-vq5p-qhp7 · GHSA
BIT-airflow-2026-31987 · OSV
CVE-2026-31987 · OSV
CVE-2026-31987 · MITRE
Track software like this
Free during beta