Information disclosure in Apache Airflow - CVE-2026-42360
Published: June 4, 2026
Vulnerability identifier: #VU133381
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42360
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper masking of sensitive information in rendered-template field handling when processing structured JSON templates that exceed the configured maximum templated field length. A remote user can read rendered template fields through the UI or API to disclose sensitive information.
Only deployments where DAG authors pass structured JSON to operators with nested sensitive keys are affected.
Affected software
Apache Airflow
How to mitigate CVE-2026-42360
Install security update from vendor's website.
Apache Airflow - update to 3.2.2