CVE-2026-68970 Overview
Apache Airflow's Task SDK fails to mask Variable contents when the deserialized JSON value is a list. Secrets stored in that shape appear in cleartext in task logs and in the Rendered Templates UI. Masking logic only handled string and dict values, leaving list-shaped Variables exposed. Any authenticated user with permission to view logs or rendered templates for a task referencing such a Variable can recover the secret values. This flaw is the list-shaped counterpart of CVE-2026-59244, whose patch covered only the dict case. Deployments that upgraded in response to the earlier advisory remain affected and must upgrade again to apache-airflow 3.3.1 or later.
Critical Impact
Authenticated users can extract sensitive secrets stored as list-shaped Airflow Variables directly from task logs and the Rendered Templates UI without special privileges.
Affected Products
- Apache Airflow Task SDK versions prior to 3.3.1
- Apache Airflow deployments that patched CVE-2026-59244 but did not upgrade further
- Any Airflow environment storing secrets in list-shaped JSON Variables
Discovery Timeline
- 2026-08-12 - CVE-2026-68970 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-68970
Vulnerability Analysis
The vulnerability is an information exposure issue [CWE-312: Cleartext Storage of Sensitive Information] in the Apache Airflow Task SDK. Airflow provides a secret-masking mechanism that redacts sensitive Variable values before they reach task logs or the web UI. The masking implementation inspects deserialized JSON values and applies redaction only when the top-level value is a string or a dictionary.
When a Variable's JSON value deserializes to a list at the top level, the masking function matches neither branch. The Task SDK returns the value unmasked, and downstream logging and template rendering treat the contents as ordinary data. Secrets embedded in list elements therefore flow through to persistent task logs and the Rendered Templates view.
This is the same class of flaw addressed in CVE-2026-59244, whose fix covered the dict case only. Operators who upgraded to remediate that advisory remain exposed if any Variable stores secrets as a list.
Root Cause
The root cause is incomplete input handling in the Variable masking routine. The code branches on value type but omits the list type, so list values bypass redaction entirely. See the upstream fix in the GitHub Pull Request for the corrected type handling.
Attack Vector
An authenticated user with read access to task logs or the Rendered Templates UI reads the exposed values directly. No exploit tooling, code execution, or privilege escalation is required. The attacker needs only permission to view a task instance that references a list-shaped Variable. Refer to the Apache Mailing List Thread for the vendor's disclosure notes.
Detection Methods for CVE-2026-68970
Indicators of Compromise
- Cleartext credential-like strings, API keys, or tokens appearing inside JSON array structures in task logs
- Rendered Templates UI entries displaying secret values that should be redacted
- Access log entries showing repeated log or template views by non-administrative accounts targeting tasks that reference sensitive Variables
Detection Strategies
- Audit all Airflow Variables and identify entries whose JSON value deserializes to a list at the top level
- Scan historical task logs for known secret patterns (API keys, tokens, connection strings) that should have been masked
- Compare Variable inventories against secret management systems to locate credentials stored inline as list elements
Monitoring Recommendations
- Enable audit logging on the Airflow web server and monitor read access to task logs and Rendered Templates endpoints
- Track user activity on tasks that reference Variables flagged as sensitive
- Alert on log volume spikes or unusual template rendering requests from non-privileged accounts
How to Mitigate CVE-2026-68970
Immediate Actions Required
- Upgrade Apache Airflow to version 3.3.1 or later across all schedulers, workers, and Task SDK deployments
- Rotate any secrets stored in list-shaped Variables, since they may already be present in historical log data
- Purge or restrict access to task logs and rendered template records that contain exposed values
- Restrict Airflow role permissions so only trusted users can read task logs and rendered templates
Patch Information
Apache has released apache-airflow 3.3.1, which extends masking to cover list-shaped Variable values. The corrective change is available in the GitHub Pull Request. Deployments that previously upgraded to remediate CVE-2026-59244 are still affected and require this additional upgrade.
Workarounds
- Refactor list-shaped secret Variables into dict-shaped structures so existing masking logic applies
- Move sensitive values out of Airflow Variables and into a dedicated secrets backend such as HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager
- Tighten role-based access control to remove log and template view permissions from non-essential accounts until the upgrade is complete
# Configuration example
pip install --upgrade 'apache-airflow>=3.3.1'
# Verify the installed version
airflow version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
