Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-31987

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

VectorNETWORK

PublishedApr 16, 2026, 14:16

Published Bysecurity@apache.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

apache-airflow(PyPI)3.0.03.2.0N/A

References

https://github.com/apache/airflow/issues/62428
https://github.com/apache/airflow/issues/62773
https://github.com/apache/airflow/pull/62964
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g
http://www.openwall.com/lists/oss-security/2026/04/16/7

Weakness Type

CWE-532

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK