BIT-airflow-2026-31987

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2026-31987.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-airflow-2026-31987
Aliases
Published
2026-04-18T08:37:43Z
Modified
2026-09-08T08:45:25Z
Summary
Apache Airflow: JWT token appearing in logs
Details

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:apache:airflow:*:*:*:*:*:python:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / airflow

Package

Name
airflow
Purl
pkg:bitnami/airflow

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.2.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2026-31987.json"