CVE-2026-68969: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-68969 is an audit log masking bypass vulnerability in Apache Airflow that causes Variable values and Connection extra contents to be written to the audit log in cleartext when submitted through bulk API endpoints (PATCH /api/v2/variables and PATCH /api/v2/connections). It affects all Apache Airflow versions prior to 3.3.1 and is classified as a distinct issue from the related CVE-2026-50204 (fixed in 3.3.0), meaning deployments that already upgraded to address that advisory remain vulnerable. The vulnerability was disclosed on August 12, 2026, with a patch released in version 3.3.1. It carries a CVSS v3.1 base score of 6.5 (Medium) (Apache Advisory, Github Advisory).

The root cause is CWE-532 (Insertion of Sensitive Information into Log File): Airflow's audit-log masking logic dispatches on top-level request field names (e.g., val/value for variables, extra for connections), but bulk API requests wrap their entities two levels deep under actions[].entities[], so the masker never encounters a recognized key and records the payload verbatim. The single-entity endpoints (POST /api/v2/variables, POST /api/v2/connections) were correctly patched in 3.3.0 via CVE-2026-50204, but the bulk code path was a separate, unaddressed divergence. Additionally, the Connection extra field is stored encrypted in the database but is written unencrypted to the audit log, creating a secondary exposure vector. The fix (PR #70890) introduces a _mask_bulk_entities helper that walks actions[].entities[] and applies existing per-entity masking before the log entry is written (GitHub PR, Github Advisory).

Any authenticated Airflow user with audit-log read access — regardless of whether they hold Variables or Connections read permissions — can recover plaintext secrets from the audit log. This includes database passwords, API keys, and other sensitive values stored in Connection extra fields, which are encrypted at rest in the connections table but exposed unencrypted in the log. The Airflow UI's Import Variables action posts to the affected bulk endpoint, meaning a routine operator action of importing a variables file silently writes every secret in that file to the audit log, broadening the exposure surface beyond deliberate API use (Apache Advisory, Github Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.154–0.358%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability requires authenticated access with audit-log read permissions, which limits the attacker pool but does not require elevated privileges such as Variables or Connections read access. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Apache Advisory).

1. Gain authenticated access: Obtain credentials for any Airflow user account that has audit-log read access. This does not require Variables or Connections read permissions.
2. Trigger secret logging via bulk endpoint: Either wait for an administrator or operator to use the Airflow UI Import Variables action (which posts to PATCH /api/v2/variables), or directly send a crafted PATCH /api/v2/variables or PATCH /api/v2/connections request containing sensitive variable values or connection extra fields.
3. Access the audit log: Navigate to the Airflow audit log UI or query the audit log API/database. Because the bulk request body bypasses masking, the submitted Variable values and Connection extra contents appear in cleartext in the log entries.
4. Extract secrets: Read the plaintext secrets (API keys, passwords, tokens) directly from the audit log entries, including Connection extra data that is otherwise encrypted in the connections table (Github Advisory, GitHub PR).

• Logs: Audit log entries for PATCH /api/v2/variables or PATCH /api/v2/connections containing plaintext secret values, API keys, or JSON blobs in the extra field rather than masked/redacted placeholders.
• Logs: Audit log entries generated by the Import Variables UI action that include unmasked variable values from imported files.
• Network: Unusual or repeated authenticated requests to PATCH /api/v2/variables or PATCH /api/v2/connections bulk endpoints from unexpected user accounts or IP addresses, particularly accounts that do not normally manage variables or connections.
• Access Patterns: Audit log read access by users who do not hold Variables or Connections read permissions, which may indicate deliberate secret harvesting from the log.

Upgrade to Apache Airflow 3.3.1 or later, which includes the fix from PR #70890 that applies per-entity masking to bulk API request bodies before audit log entries are written. Notably, upgrading to 3.3.0 (the fix for the related CVE-2026-50204) is not sufficient — deployments on 3.3.0 must upgrade again to 3.3.1. As interim measures: restrict audit-log read access to only users who require it; avoid using the Import Variables UI action with files containing secrets until patched; and rotate any secrets (passwords, API keys, tokens) that may have been exposed in audit logs. Review existing audit logs for cleartext secrets in bulk endpoint entries (Apache Advisory, GitHub PR).

The Apache Software Foundation disclosed the vulnerability via their security mailing list on August 12, 2026, explicitly noting that it is a distinct code path from CVE-2026-50204 and that users who already upgraded to 3.3.0 must upgrade again. The fix was authored by Apache Airflow maintainer potiuk and merged on August 3, 2026, ahead of the public disclosure. The NixOS security tracker opened a tracking issue for affected Apache Airflow packages, and the vulnerability was indexed by OSV.dev as PYSEC-2026-3711 (Apache Advisory, GitHub PR).