Dashboard / CVE-2026-32690

CVE-2026-32690

LOW
INFO Priority: 0.02 BB Relevance: 57/100
Published: 2026-04-18 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: None

Description

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
apache airflow 3.0.0 – 3.2.0

References & Advisories (3)

Bug Bounty Relevance

57 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

3.7 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — Exploitation Probability

0.42%
Raw Score 0.004210
Percentile 36.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00421
2026-10-28
0.00421

Intelligence Sources

nvd ref →

External Links