CVE-2026-31987

Published: Apr 16, 2026 Last Modified: Apr 16, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors.
Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

532

Insertion of Sensitive Information into Log File

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
http://www.openwall.com/lists/oss-security/2026/04/16/7
http://www.openwall.com/lists/oss-security/2026/04/16/7
https://github.com/apache/airflow/issues/62428
https://github.com/apache/airflow/issues/62428
https://github.com/apache/airflow/issues/62773
https://github.com/apache/airflow/issues/62773
https://github.com/apache/airflow/pull/62964
https://github.com/apache/airflow/pull/62964
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw7…
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g