GitHub Advisoryadvisory · PyPI

GHSA-phv5-vq5p-qhp7 Apache Airflow: JWT token appearing in logs

MEDIUM Published 2026-04-16 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-31987
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2026-04-16

Affected packages

• PyPI apache-airflow: >= 3.0.0, < 3.2.0 → fixed in 3.2.0

Description

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-31987 JWT Tokens used by tasks were exposed in logs. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References