{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow-core","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.3.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-68970","cwes":["CWE-312"],"description":"Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.","epss":{"date":"2026-11-02","percentile":0.13863,"score":0.0023},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793689222374,"publishedAt":1786548293217,"references":[{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/70891"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28"},{"source":"CNA: apache","tags":["related"],"url":"https://www.cve.org/CVERecord?id=CVE-2026-59244"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/70891"}],"revision":"302979dec81eea40988a717a2178fafa5043e59643c9dce96982aa16d562cc18","sources":[{"modifiedAt":1793689222374,"name":"CNA: apache","retrievedAt":1793693357469,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68970"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793693365395,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68970"}],"ssvc":{"assessedAt":1786561236231,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI","updatedAt":1793693365395}