CVE-2026-68969 in Airflow
Summary
by MITRE • 08/12/2026
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical information disclosure flaw in Apache Airflow that stems from inadequate audit log masking mechanisms applied to bulk API endpoints. The issue occurs specifically when variables and connection details are submitted through the PATCH /api/v2/variables and PATCH /api/v2/connections bulk endpoints, where sensitive data flows through nested request structures that bypass existing security controls. The root cause lies in the audit logging system's failure to recognize that these bulk operations contain deeply nested entities two levels below the top-level request fields, resulting in cleartext exposure of variable values and connection extra contents.
The technical implementation flaw manifests as a mismatch between the audit log masking logic and the actual request structure. Standard audit log masking typically operates on first-level request parameters, but bulk endpoints structure their data with entities nested within additional object layers, causing the existing security controls to be ineffective. When authenticated users with read access to audit logs interact with these endpoints, they can directly extract sensitive information without requiring any specific permissions for variables or connections themselves. This creates a privilege escalation scenario where minimal access to logging systems translates into full data exposure capabilities.
The operational impact of this vulnerability is severe and multifaceted across multiple attack vectors. The Connection extra field storage presents the most significant risk since it contains unencrypted copies of sensitive information in the audit logs, despite the underlying database storing these values encrypted. This creates a scenario where attackers can access connection details including credentials, API keys, and other authentication materials that should remain protected. The import functionality within the Airflow UI amplifies this risk significantly, as ordinary operators performing routine import operations inadvertently write all secrets from imported files directly to audit logs without any filtering or masking.
The vulnerability's persistence requires additional remediation beyond previous security advisories, specifically CVE-2026-50204 which addressed single-entity endpoints but not bulk operations. Deployments that upgraded solely in response to the earlier advisory remain vulnerable because the fix did not cover these nested bulk request paths, creating a false sense of security for organizations that believed their systems were protected. This highlights the importance of comprehensive vulnerability assessments that consider all code paths rather than isolated endpoint protections.
Organizations should prioritize upgrading to Apache Airflow version 3.3.1 or later to address this issue comprehensively. The fix implemented in this version ensures proper audit log masking mechanisms recognize and protect nested request structures, preventing sensitive data exposure through bulk operations. Security teams should also implement monitoring for audit log access patterns and consider additional controls such as log rotation policies and restricted access to audit logging systems to minimize potential impact while awaiting upgrades.
This vulnerability aligns with CWE-200 (Information Exposure) and represents a failure in proper input sanitization and output filtering within the application's security architecture. From an attack perspective, it maps to ATT&CK technique T1567 (Exfiltration Over Web Service) and T1531 (Account Access Removal) through unauthorized access to sensitive data through logging systems rather than direct system compromise. The attack surface extends beyond typical API exploitation scenarios and encompasses operational security failures where legitimate administrative functions become vectors for information leakage.
The remediation approach must consider both immediate protection through version upgrades and longer-term architectural improvements to audit logging systems. Organizations should conduct comprehensive audits of their logging configurations to ensure all nested data structures are properly masked, implement regular security testing of bulk API operations, and establish clear policies governing who can access audit logs containing sensitive information. This vulnerability demonstrates the critical importance of thorough security review processes that examine not just individual components but also how they interact within complex application workflows.