CVE-2026-68970: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-68970 is a cleartext storage vulnerability in Apache Airflow's Task SDK that causes secrets stored in list-shaped Variables to appear unmasked in task logs and the Rendered Templates UI. The _mask_and_deserialize_variable function only applied masking when the deserialized JSON value was a str or dict; a top-level list matched neither branch and was returned in plaintext. All Apache Airflow versions prior to 3.3.1 are affected. It was disclosed on August 12, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Apache Advisory). This vulnerability is the list-shaped counterpart of CVE-2026-59244, meaning deployments that already upgraded in response to that earlier advisory remain affected and must upgrade again (Github Advisory).

The root cause is classified as CWE-312 (Cleartext Storage of Sensitive Information). Within the Task SDK, the _mask_and_deserialize_variable function in task-sdk/src/airflow/sdk/execution_time/context.py dispatched on the top-level Python type of the deserialized Variable value, handling only str and dict cases. When a Variable's JSON value was a top-level list, no branch matched, so the entire list — including any sensitive elements — was returned without invoking the masker. Notably, add_mask does walk iterables internally, meaning lists nested one level inside a dict were already masked; only a top-level list was skipped. The fix (PR #70891) adds a list branch that passes the value under the variable's key, preserving the existing sensitivity semantics without over-masking non-sensitive list values such as region names (GitHub PR).

Any authenticated Airflow user with read access to task logs or the Rendered Templates UI can recover the plaintext contents of Variables whose JSON value is a list — no special privileges or configuration are required beyond standard authenticated access. This exposes credentials, API keys, tokens, or other secrets stored in list-shaped Variables, potentially enabling lateral movement to downstream systems or cloud services that rely on those secrets. There is no integrity or availability impact; the vulnerability is limited to confidentiality (Github Advisory, Apache Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the advisory date (Apache Advisory). The vulnerability is not automatable in the SSVC sense, as it requires an authenticated user to navigate to task logs or the Rendered Templates UI. The EPSS score is approximately 0.17–0.23%, placing it in the lower percentiles for near-term exploitation likelihood (Github Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Authenticate: Log in to the Apache Airflow web UI with any valid user account that has read access to DAG task logs or the Rendered Templates view.
2. Identify target Variables: Browse or enumerate Airflow Variables (via the UI or Airflow CLI) to identify those whose JSON values are lists (e.g., ["secret1", "secret2"]).
3. Trigger a task run: Execute or wait for a DAG task that references the target Variable using Variable.get() or the task context.
4. Access task logs: Navigate to the task instance logs in the Airflow UI. Because masking was not applied to list-shaped values, the plaintext list contents appear directly in the log output.
5. Access Rendered Templates UI: Alternatively, open the Rendered Templates view for the task instance; the unmasked Variable contents are displayed there as well.
6. Extract secrets: Copy the cleartext values from the logs or rendered templates for use in further attacks against dependent systems (GitHub PR, Github Advisory).

• Logs: Airflow task logs containing plaintext list-shaped Variable values (e.g., JSON arrays with credential strings) where masking (***) would be expected; review logs for Variables known to hold secrets.
• Logs: Airflow web server access logs showing repeated or unusual GET requests to /log or /rendered-templates endpoints for tasks that reference sensitive Variables, particularly from accounts not normally associated with those DAGs.
• Logs: Audit log entries (if enabled) showing Variable read events by users who do not normally access those Variables or task logs.

Upgrade to Apache Airflow 3.3.1 or later, which includes the fix for both CVE-2026-68970 (list case) and the previously patched CVE-2026-59244 (dict case) (Apache Advisory, GitHub PR). Organizations that already upgraded in response to CVE-2026-59244 must upgrade again, as that fix did not cover list-shaped Variables. As an interim workaround, restrict access to task logs and the Rendered Templates UI to only trusted, authorized personnel, and audit existing Variables to identify and rotate any secrets stored in list format.