What is CVE-2026-68970?

CVE-2026-68970 is a medium-severity vulnerability in Apache Software Foundation Airflow, classified under Cleartext Storage of Sensitive Information. CVSS score: 6.5/10. Published 2026-08-12.

How severe is CVE-2026-68970?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Apache Software Foundation Airflow

CVE-2026-68970

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserializ…

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Software Foundation Airflow — versions 0

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

References

security@apache.org (patch)
security@apache.org (related)
security@apache.org (vendor-advisory)

Frequently asked questions

What is CVE-2026-68970?: CVE-2026-68970 is a medium-severity vulnerability in Apache Software Foundation Airflow, classified under Cleartext Storage of Sensitive Information. CVSS score: 6.5/10. Published 2026-08-12.
How severe is CVE-2026-68970?: Medium severity. CVSS v3 base score is 6.5 out of 10.