CVE-2026-68970: 
Homebrew Schwachstellenanalyse und -minderung

CVE-2026-68970 is a cleartext storage vulnerability in Apache Airflow's Task SDK that causes secrets stored in list-shaped JSON Variables to appear unmasked in task logs and the Rendered Templates UI. The _mask_and_deserialize_variable function only applied masking when the deserialized top-level value was a str or dict; a top-level list matched neither branch and was returned entirely unmasked. All versions of Apache Airflow prior to 3.3.1 are affected. The vulnerability was disclosed on August 12, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Apache Advisory, GitHub Advisory). It is the list-shaped counterpart of CVE-2026-59244, meaning deployments that already upgraded in response to that earlier advisory remain vulnerable and must upgrade again (GitHub Advisory).

The root cause is CWE-312 (Cleartext Storage of Sensitive Information): the _mask_and_deserialize_variable method in the Task SDK dispatched on the top-level Python type of a deserialized Variable value and handled only str and dict, leaving list as an unhandled case that bypassed all masking logic entirely. Because add_mask internally walks dicts and iterables, list values nested one level inside a dict were already masked — only a top-level list was skipped. The fix (PR #70891) adds a list branch that passes the value under the variable's key rather than anonymously, so elements inherit the variable key's sensitivity without over-masking non-sensitive list values (e.g., region names) globally (GitHub PR). No special configuration or elevated privileges are required beyond authenticated access to task logs or the Rendered Templates UI.

Any authenticated Airflow user with read access to task logs or the Rendered Templates UI can recover secrets stored in list-shaped Variables in cleartext, with no additional exploitation steps required. The confidentiality impact is high — credentials, API keys, tokens, or other sensitive values stored as JSON lists are fully exposed. Integrity and availability are not affected, but exposed credentials could enable lateral movement to downstream systems or cloud services referenced by those secrets (GitHub Advisory, Apache Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.17–0.23%, placing it in the 14th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only low privileges (authenticated access), no user interaction, and is network-accessible, making it straightforward for any insider or compromised account to abuse.

1. Authenticate: Log in to the Apache Airflow web UI with any valid user account that has permission to view task logs or the Rendered Templates UI.
2. Identify target Variables: Browse or enumerate Airflow Variables to identify those whose JSON values are top-level lists (e.g., ["secret1", "secret2"] or [{"password": "hunter2"}]).
3. Trigger task execution: Run or wait for a DAG task that references the target Variable via Variable.get() or template rendering.
4. Access task logs: Navigate to the task's log output in the Airflow UI or retrieve logs from the configured log backend; the list contents will appear in cleartext rather than being redacted.
5. Access Rendered Templates UI: Alternatively, open the task's "Rendered Template" view in the Airflow UI to see the unmasked Variable value directly in the rendered template output.
6. Extract secrets: Copy the cleartext credentials, tokens, or other sensitive values from the logs or rendered template for use in further attacks (GitHub PR, GitHub Advisory).

• Logs: Airflow task logs containing JSON list values from Variables that should be masked (e.g., ['secret_value', 'another_secret'] appearing in plaintext rather than ['***', '***']); repeated access to task logs or rendered templates for tasks referencing sensitive Variables by unusual or low-privileged accounts.
• Network: Unusual outbound connections from the Airflow worker or webserver to external IPs shortly after task execution, potentially indicating credential use following exfiltration.
• Application Activity: Audit log entries showing frequent or anomalous access to the Rendered Templates UI or task log endpoints (/log, /rendered-templates) by accounts not normally associated with those tasks.

Upgrade to Apache Airflow 3.3.1 or later, which includes the fix from PR #70891 that adds proper masking for top-level list-shaped Variable values (Apache Advisory, GitHub PR). No configuration-based workaround fully mitigates the issue; however, as an interim measure, restrict access to task logs and the Rendered Templates UI to the minimum necessary users until patching is complete. After upgrading, audit existing task logs and rendered template history for potential prior exposure of list-shaped Variables containing secrets, and rotate any credentials that may have been exposed.

The Apache Software Foundation published the security advisory on August 12, 2026, explicitly noting that deployments that had already upgraded in response to the related CVE-2026-59244 advisory remain affected and must upgrade again (Apache Advisory). No significant independent researcher commentary or broad media coverage has been identified beyond standard CVE tracking and aggregator sites.