CVE-2026-68969: Apache Airflow Information Disclosure Bug

CVE-2026-68969 Overview

Apache Airflow logs Variable values and Connection extra contents in cleartext when submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking logic only inspects top-level request fields. Bulk requests nest their entities two levels deeper, so masking never applies. Any authenticated user with audit-log read access can recover secrets verbatim, even without Variables or Connections read permission. The Airflow UI's Import Variables action posts to this endpoint, meaning routine operator imports leak every secret in the file. Connection extra data is stored encrypted in the connection table but appears unencrypted in the audit log. This flaw affects a different code path than CVE-2026-50204, whose fix in 3.3.0 only covered single-entity endpoints.

Critical Impact
Authenticated users with only audit-log read access can retrieve Variables, Connection credentials, and Connection extra payloads in cleartext, bypassing the platform's secret masking and encryption controls.

Affected Products

Apache Airflow versions prior to 3.3.1
Apache Airflow 3.3.0 deployments patched only for CVE-2026-50204
Airflow instances exposing the bulk PATCH /api/v2/variables and PATCH /api/v2/connections endpoints

Discovery Timeline

2026-08-12 - CVE-2026-68969 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68969

Vulnerability Analysis

The vulnerability is an information exposure through log files, classified under [CWE-532]. Apache Airflow applies audit-log masking to redact sensitive request fields such as Variable values and Connection secrets. The masking routine walks only the top-level keys of the incoming JSON body.

Bulk endpoints accept an envelope structure where entities appear two levels below the root, typically inside an actions array containing per-entity payloads. Because the masker never descends into nested arrays and objects, none of the sensitive fields are recognized as secrets. The unmasked values are written directly to the audit log.

The Connection extra field compounds the exposure. The connection table stores this value encrypted using the Fernet key, but the audit log entry stores the plaintext representation. An attacker with audit-log access retrieves credentials that would otherwise require the Fernet key to decrypt.

Root Cause

The root cause is incomplete input traversal in the audit-log masking function. The prior fix for CVE-2026-50204 addressed only single-entity endpoints, leaving the bulk request schema unhandled. Deployments that upgraded to 3.3.0 in response to that advisory remain vulnerable to this variant.

Attack Vector

An authenticated user with audit-log read permission queries the audit log to retrieve bulk request bodies. The Airflow permission model does not require the attacker to hold Variables or Connections read access. Any operator import performed through the UI's Import Variables action writes the full contents of the imported file to the log, providing a passive exfiltration channel. See the GitHub Pull Request for the code-level fix.

Detection Methods for CVE-2026-68969

Indicators of Compromise

Audit-log entries referencing PATCH /api/v2/variables or PATCH /api/v2/connections that contain unredacted value or extra fields
Unusual read activity against the audit-log API by accounts without Variables or Connections roles
Bulk import operations performed by non-administrative operators immediately preceded or followed by audit-log queries

Detection Strategies

Parse audit-log records and flag any bulk endpoint payload where nested entity fields are present in cleartext rather than as *** masking tokens
Correlate audit-log read events with prior bulk PATCH operations to identify potential secret harvesting patterns
Compare stored Connection extra ciphertext against audit-log entries to identify records that leak plaintext copies

Monitoring Recommendations

Alert on audit-log API access from role assignments that lack Variables and Connections read scope
Baseline the volume and source of Import Variables actions and investigate deviations
Forward Airflow audit logs to a centralized store and apply retention controls that limit blast radius from compromised accounts

How to Mitigate CVE-2026-68969

Immediate Actions Required

Upgrade Apache Airflow to version 3.3.1 or later, including deployments already patched for CVE-2026-50204
Rotate all Variables and Connection credentials that may have transited the bulk endpoints since deployment
Purge or restrict access to historical audit-log entries containing unmasked secrets
Review and reduce audit-log read role assignments to a minimum set of trusted administrators

Patch Information

The fix is available in Apache Airflow 3.3.1. Details of the change are documented in the upstream GitHub Pull Request and announced on the Apache Mailing List Thread. The patch extends the masking traversal to recurse into nested entity payloads used by bulk endpoints.

Workarounds

Restrict the audit-log read permission to administrators until the upgrade is applied
Disable or block the bulk PATCH /api/v2/variables and PATCH /api/v2/connections endpoints at the reverse proxy where feasible
Instruct operators to avoid the UI Import Variables action and instead use per-variable creation flows until patched
Sanitize or truncate audit-log entries generated by bulk endpoints through a preprocessing layer

bash

# Upgrade Apache Airflow to the patched release
pip install --upgrade 'apache-airflow>=3.3.1'

# Verify the installed version
airflow version