CVE-2026-32690: Apache Airflow information exposure in JSON dictionary variables

CVE-2026-32690 · Severity: low · CVSS 3.7 · Published 2026-04-18

Apache Airflow is a platform used to programmatically author, schedule, and monitor workflows. A vulnerability exists where sensitive information, such as passwords or API keys, stored within JSON-formatted variables is not properly hidden when viewed by users. This could lead to the accidental exposure of credentials to individuals who have access to view variables but should not see the underlying secrets.

Technologies: Apache Airflow, apache-airflow (PyPI), apache-airflow-core (PyPI). Vendors: Apache, Apache Software Foundation, PyPI.

Quick answers

Is CVE-2026-32690 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32690 being exploited in the wild.
How severe is CVE-2026-32690?
Low severity, with a CVSS score of 3.7, published 18 April 2026.
Which products and versions are affected?
apache-airflow (PyPI) >= 3.0.0, < 3.2.0, ECOSYSTEM:introduced=3.0.0,fixed=3.2.0; apache-airflow-core (PyPI) >= 3.0.0, < 3.2.0, ECOSYSTEM:introduced=3.0.0,fixed=3.2.0.
Is there a fix for CVE-2026-32690?
Yes. apache-airflow (PyPI): upgrade to 3.2.0 or later; apache-airflow-core (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32690 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32690?
Check whether you run Apache Airflow, Apache Software Foundation Airflow Core, apache-airflow (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • apache-airflow (PyPI): upgrade to 3.2.0 or later
    pip install "apache-airflow>=3.2.0"
  • apache-airflow-core (PyPI): upgrade to 3.2.0 or later
    pip install "apache-airflow-core>=3.2.0"

Technical details

A vulnerability in Apache Airflow's variable redaction mechanism fails to mask secrets when they are stored as nested fields within JSON dictionaries. The root cause is an insufficient redaction depth setting when processing Variable objects, which allows nested sensitive values to remain in plaintext when retrieved via the API or UI. An attacker with network access to the Airflow interface or API could potentially view these unmasked secrets if they have permissions to retrieve variables. The issue is fixed in version 3.2.0 by implementing a default maximum depth for redaction.

Affected products

  • Apache apache-airflow-core >= 3.0.0, < 3.2.0
  • Apache apache-airflow >= 3.0.0, < 3.2.0

Identifiers

  • CVE-2026-32690
  • GHSA-w9r4-94fj-xp69
  • PYSEC-2026-19
  • PYSEC-2026-2362

Timeline

  • 2026-03-13: patched: Pull request merged into main branch
  • 2026-04-18: disclosed: Initial advisory publication
  • 2026-04-18: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.