~ / search / GHSA-phv5-vq5p-qhp7

GHSA-phv5-vq5p-qhp7

Apache Airflow: JWT token appearing in logs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-31987

Packages

EcosystemPackageAffectedFixed in
PyPI apache-airflow >= 3.0.0, < 3.2.0 3.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.