{"id":"CVE-2026-59244","aliases":[],"cve":{"records":[{"id":"CVE-2026-59244","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-04T00:20:30.244Z","published":"2026-08-12T15:43:17.373Z","modified":"2026-11-03T06:58:57.180Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-03T06:58:57.180Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-08-12T17:20:19.495Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-08-18T19:53:25.636Z"}],"references":[{"url":"https://github.com/apache/airflow/pull/68975","tags":["patch"],"source":"apache"},{"url":"https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/12/7","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-312","description":"CWE-312: Cleartext Storage of Sensitive Information","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-08-18T13:43:56.777503Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI","titleSource":"apache","descriptionSource":"apache","description":"Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.","score":6.5,"severity":"medium","published":"2026-08-12T15:43:17.373Z","modified":"2026-11-03T06:58:57.180Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.0.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-59244"},{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"3.0.0","status":"affected","lessThan":"3.3.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow-core","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-59244"}],"remediation":[],"references":["https://github.com/apache/airflow/pull/68975","https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6","http://www.openwall.com/lists/oss-security/2026/08/12/7"],"sources":[{"name":"CVE","id":"CVE-2026-59244","modified":"2026-11-03T06:58:57.180Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-59244"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-03T07:11:26.626Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:15:33.603Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-03T07:30:32.834Z","attemptedAt":"2026-11-03T07:30:32.834Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-03T07:30:32.722Z","attemptedAt":"2026-11-03T07:30:32.722Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-03T07:30:33.115Z","attemptedAt":"2026-11-03T07:30:33.115Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-03T07:30:32.647Z","attemptedAt":"2026-11-03T07:30:32.647Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-59244","url":"https://www.first.org/epss/","probability":0.0023,"percentile":0.13863,"date":"2026-11-02","checkedAt":"2026-11-03T07:30:32.647Z"},{"source":"GitHub Advisory Database","id":"GHSA-f643-3rc2-j27w","url":"https://github.com/advisories/GHSA-f643-3rc2-j27w","modified":"2026-10-02T23:13:16Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-03T07:30:32.722Z"},{"source":"NVD","id":"CVE-2026-59244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59244","modified":"2026-11-03T07:20:56.160","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-03T07:30:32.834Z"},{"source":"NVD","id":"CVE-2026-59244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59244","modified":"2026-11-03T07:20:56.160","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-03T07:30:32.834Z"},{"source":"ENISA EUVD","id":"EUVD-2026-57316","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57316","modified":"Sep 16, 2026, 2:56:04 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-03T07:30:33.115Z"}],"aiSummary":{"text":"Apache Airflow versions before 3.3.1 have a weakness where `var.json` variable values are not masked in the Rendered Templates UI, potentially exposing secrets to users with access. The issue is due to the secrets masker not handling dict values. Users with access to the task's Rendered Templates view can see the secret in cleartext.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T07:16:09.421Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-59244"}]}}