CVE-2026-31987

HIGH EPSS 49.9%
Published Apr 16, 20262mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Apr 16, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
49.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-532

Affected Products 1

VendorProductVersionRange
apacheairflow*≥3.0.0  –  <3.2.0

References 5

  • openwall.com http://www.openwall.com/lists/oss-security/2026/04/16/7
    Mailing ListThird Party Advisory
  • github.com https://github.com/apache/airflow/issues/62428
    Issue Tracking
  • github.com https://github.com/apache/airflow/issues/62773
    Issue Tracking
  • github.com https://github.com/apache/airflow/pull/62964
    Issue TrackingPatchThird Party Advisory
  • lists.apache.org https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g
    Mailing ListVendor Advisory

Remediation

  • github.com https://github.com/apache/airflow/pull/62964
    Issue TrackingPatchThird Party Advisory