CVE-2026-68969

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description Sensitive data, including Variable values and Connection extra contents, are written to the audit log in cleartext when submitted via the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. This occurs because the audit-log masking mechanism only recognizes top-level request fields, while bulk requests nest entities two levels deeper, bypassing the masking process. Consequently, any authenticated user with audit-log read access can recover these secrets, even if they lack specific permissions to read Variables or Connections. Additionally, the Connection extra data is stored unencrypted in the log, despite being encrypted in the connection table. This issue is also triggered by the Airflow UI's Import Variables action.

Recommendations Upgrade to apache-airflow version 3.3.1 or later.