PyPI: apache-airflow-core
CVE-2026-32690
Safety vulnerability ID: SFTY-20260418-37343
Affected versions of the `apache-airflow-core` package are vulnerable to Information Disclosure due to incomplete secret redaction for Variables stored as JSON dictionaries. The redaction logic fails to mask secret values held within nested fields of the JSON structure when these Variables are retrieved, resulting in their return in original form. A user with permission to retrieve Variables can therefore obtain sensitive secret values stored in nested JSON fields that were intended to be masked.
Overview
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Advisory
apache-airflow-core – Exposure of Resource to Wrong Sphere
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260418-37343/CVE-2026-32690
- https://nvd.nist.gov/vuln/detail/CVE-2026-32690
- https://github.com/apache/airflow/pull/63480
- https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5
- http://www.openwall.com/lists/oss-security/2026/04/17/6
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-19.yaml
- https://github.com/advisories/GHSA-w9r4-94fj-xp69
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more