CVE-2026-32690General(apache / airflow)

LOWCVSS 3.7 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://github.com/apache/airflow/pull/63480

Weakness type (CWE)

CWE-668

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

airflow

Threat summary

4 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked 3d ago at 1 mentions (2026-04-17); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

apache

Products

airflow

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

General

250.0%

Disclosure

250.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-17	1	General1
2026-04-18	1	Disclosure1
2026-04-19	1	General1
2026-06-20	1	Disclosure1

Full discourse4 posts

Open Source Security mailing list@oss_security172d
General
Apache Airflow CVE-2026-31987: JWT token appearing in logs https://www.openwall.com/lists/oss-security/2026/04/16/7 CVE-2026-30912: Exposing stack trace in case of constraint error https://www.openwall.com/lists/oss-security/2026/04/17/5 CVE-2026-32690: Nested Variable Secret Values Bypass Redaction via max_depth=1 https://www.openwall.com/lists/oss-security/2026/04/17/6
Post summary
The post enumerates three Apache Airflow CVEs with concise technical descriptions, but provides no proof of concepts, exploit code, patches, or evidence of active exploitation.
1000066
4.5K followersView on X
DailyCVE@dailycve111d
Disclosure
🟠 pydantic-settings Path Traversal, #CVE-2026-32690 (Medium) -DC-Jun2026-536 https://dailycve.com/pydantic-settings-path-traversal-cve-2026-32690-medium-dc-jun2026-536/
Post summary
The tweet announces the discovery of a medium‑severity path traversal vulnerability in pydantic-settings, identified as CVE‑2026‑32690.
0000038
215 followersView on X
CVE@CVEnew173d
Disclosure
CVE-2026-32690 Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields wer… https://www.cve.org/CVERecord?id=CVE-2026-32690
Post summary
The post briefly describes how secrets saved in JSON dictionary variables were improperly redacted, potentially exposing nested secrets, and links to the CVE record.
0000052
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds174d
General
CVE-2026-32690 CVE-2026-32690 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32690
Post summary
The content merely lists CVE-2026-32690 with a link to a vulnerability page, offering no further actionable details.
0000044
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	airflow	-	-	-

Explore more

Back to dashboard apache CVEs airflow vulnerabilities