VulnerabilityAnalyzed
CVE-2026-31987
JWT Tokens used by tasks were exposed in logs.
HIGH 7.5EPSS 0.74%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.74%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.74% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-532
- Affected
- apache/airflow
- Source
- security@apache.org
References
- https://github.com/apache/airflow/issues/62428Issue Tracking
- https://github.com/apache/airflow/issues/62773Issue Tracking
- https://github.com/apache/airflow/pull/62964Issue Tracking, Patch, Third Party Advisory
- https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6gMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/16/7Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.