{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow-core","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.3.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-68969","cwes":["CWE-532"],"description":"Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.","epss":{"date":"2026-11-02","percentile":0.29562,"score":0.00358},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793689216212,"publishedAt":1786548400095,"references":[{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/70890"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c"},{"source":"CNA: apache","tags":["related"],"url":"https://www.cve.org/CVERecord?id=CVE-2026-50204"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/70890"}],"revision":"697199da558cd0e5e5963ac6c91027714f3c63417c7fba77192e98ce747724c9","sources":[{"modifiedAt":1793689216212,"name":"CNA: apache","retrievedAt":1793693356249,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68969"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793693365496,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68969"}],"ssvc":{"assessedAt":1786623081550,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext","updatedAt":1793693365496}