CVE-2026-59244: Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI
Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstance(str) guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59244?
The severity of CVE-2026-59244 is classified as risk 33.
How do I fix CVE-2026-59244?
To fix CVE-2026-59244, apply the latest patch or update for Apache Airflow that addresses the secrets masking issue.
What systems are affected by CVE-2026-59244?
CVE-2026-59244 affects Apache Airflow installations that utilize the secrets masker for handling variable values.
What are the potential consequences of CVE-2026-59244?
The potential consequences of CVE-2026-59244 include unauthorized access to sensitive information as secret values may be exposed in cleartext.
Is there a workaround for CVE-2026-59244 before a fix is available?
As a temporary workaround for CVE-2026-59244, restrict access to the Rendered Templates UI for users who shouldn't see sensitive data.