CVE-2026-68969
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when submitted through bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking only recognized top-level request fields, and a bulk request nests entities two levels below, so no masking was applied. Any authenticated user with audit-log read access (not necessarily holding Variables or Connections read permissions) could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it.
Risk Assessment
The risk is exposure of sensitive data (secrets, passwords, API keys) to the audit log, which may be accessible to a broader set of users. An attacker with log access can read these secrets, potentially leading to compromise of systems and data. Additionally, the Airflow UI's 'Import Variables' action posts to this endpoint, so an ordinary operator import writes every secret in the file to the log.
Recommendation
Upgrade Apache Airflow to version 3.3.1 or later immediately. If you previously applied the fix for CVE-2026-50204 (version 3.3.0), note that it only covers single-entity endpoints, so upgrading to 3.3.1 is still required.
Original NVD description (English source)
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.