VULNERABILITY INTELLIGENCE

CVE-2026-31987

CVSS score7.5 HIGH

EPSS probability0.74%

CISA KEVNot currently listed

Published2026-04-16

Last modified2026-10-26

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Weakness classification

security@apache.org: CWE-532

Primary references

security@apache.org — Issue Tracking
security@apache.org — Issue Tracking
security@apache.org — Issue Tracking, Patch, Third Party Advisory
security@apache.org — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory