Is CVE-2026-68969 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68969 being exploited in the wild.

How severe is CVE-2026-68969?

Medium severity, with a CVSS score of 6.5, published 12 August 2026.

Which products and versions are affected?

Apache Airflow below 3.3.1; apache-airflow (PyPI) < 3.3.1, ECOSYSTEM:introduced=0,fixed=3.3.1.

Is there a fix for CVE-2026-68969?

Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68969 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-68969?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68969: Apache Airflow information disclosure in audit logs

Q: Is there a fix for CVE-2026-68969?

Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-68969 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-68969?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68969 · Severity: medium · CVSS 6.5 · Published 2026-08-12

Apache Airflow's audit logging feature inadvertently recorded sensitive information—variable values and database connection credentials—in plaintext when submitted through bulk API endpoints. Any authenticated user with access to the audit log, even without permission to view variables or connections themselves, could recover these secrets. This affects the UI's import function, exposing all secrets from imported files to the audit log permanently.

Technologies: Apache Airflow, apache-airflow (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2026-68969 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68969 being exploited in the wild.
How severe is CVE-2026-68969?: Medium severity, with a CVSS score of 6.5, published 12 August 2026.
Which products and versions are affected?: Apache Airflow below 3.3.1; apache-airflow (PyPI) < 3.3.1, ECOSYSTEM:introduced=0,fixed=3.3.1.
Is there a fix for CVE-2026-68969?: Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68969 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-68969?: Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 3.3.1 or later
```
pip install "apache-airflow>=3.3.1"
```

Technical details

The vulnerability is an information disclosure flaw in Apache Airflow's audit logging mechanism. When bulk API endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`) process requests, the audit-log masking logic fails to redact sensitive fields because entities are nested two levels deep in bulk requests, while the masking logic only checks top-level fields. Connection `extra` contents remain unencrypted in the audit log despite being encrypted in the database. The attack requires network access to Airflow's API and authentication, but no elevated privileges beyond audit-log read access. The Airflow UI's Import Variables feature uses this vulnerable endpoint, automatically exposing imported secrets. A prior fix (CVE-2026-50204) addressed single-entity endpoints only, leaving bulk endpoints unpatched. The fix was merged on 2026-08-03 and shipped in version 3.3.1.

Affected products

Apache Airflow below 3.3.1

Identifiers

CVE-2026-68969
BIT-AIRFLOW-2026-68969
GHSA-cjv4-7hp2-2x9h
PYSEC-2026-3711

Timeline

2026-08-12: disclosed
2026-08-03: patched: Fix merged in PR #70890, shipped in Airflow 3.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.