Apache Airflow: JWT token appearing in logs_CVE-2026-31987

7.5 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors.
Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Basic Information

ID CVE-2026-31987

Source apache

Published Apr 16, 2026 at 13:31

Modified Apr 18, 2026 at 02:28

Affected Product

Vendor Apache Software Foundation

Product Apache Airflow

Version 3.0.0

Affected Versions Apache Software Foundation Apache Airflow 3.0.0

CWE Classification

CWE-532

References

{
    "lastseen": "",
    "description": "JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. \nUsers are advised to upgrade to Airflow version that contains fix.\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue.",
    "published": "2026-04-16T13:31:52.336Z",
    "modified": "2026-04-18T02:28:44.770Z",
    "type": "cve",
    "title": "Apache Airflow: JWT token appearing in logs",
    "source": "apache",
    "references": "https://github.com/apache/airflow/pull/62964\nhttps://github.com/apache/airflow/issues/62428\nhttps://github.com/apache/airflow/issues/62773\nhttps://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g",
    "id": "CVE-2026-31987",
    "bulletinFamily": "",
    "cwe": [
        "CWE-532"
    ],
    "cvelist": null,
    "sourceData": "Apache Software Foundation Apache Airflow 3.0.0",
    "sourceHref": "",
    "cvss": {
        "score": 7.5,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Apache Airflow",
    "version": "3.0.0",
    "vendor": "Apache Software Foundation",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}