CVE-2026-68970

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description The Task SDK fails to mask the contents of a Variable when its JSON value is a list. This occurs because masking is only applied to deserialized values that are strings or dictionaries, leaving top-level lists unmasked. Consequently, secrets stored in this format are displayed in cleartext within task logs and the Rendered Templates UI. An authenticated user with permissions to view task logs or rendered templates can recover these values without any special configuration.

Recommendations Upgrade to apache-airflow version 3.3.1 or later.