PT-2026-33314 · Apache · Apache Airflow

Jason Imison + 2 · Published 2026-04-16 · Updated 2026-04-19 · CVE-2026-31987

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0

Description JWT Tokens used by tasks were exposed in logs. This exposure could allow UI users to act as Dag Authors.

Recommendations Upgrade to version 3.2.0.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-AIRFLOW-2026-31987

CVE-2026-31987

GHSA-PHV5-VQ5P-QHP7

Affected Products

Apache Airflow

References · 13

• https://github.com/apache/airflow/pull/62964 · Patch
• https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31987 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2026-31987 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-phv5-vq5p-qhp7 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/issues/62428 · Note
• https://github.com/apache/airflow/issues/62773 · Note
• https://twitter.com/VulmonFeeds/status/2044876496141942838 · Twitter Post
• https://twitter.com/CVEnew/status/2045102680134091166 · Twitter Post
• https://twitter.com/infoflowcloud/status/2045105225027989753 · Twitter Post
• https://twitter.com/oss_security/status/2045900381931086041 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/16/7 · Note