Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-31987
7.5
HIGHCVSS v3
Published
April 16, 2026
Affected
2 projects
Assigned by
Apache
Severity scale
010
Description
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.
apache/airflow
GitHubApache Airflow - A platform to programmatically author, schedule, and monitor workflows
GitHubApache Airflow - A platform to programmatically author, schedule, and monitor workflows>= 3.0.0, < 3.2.0NVD
Docker Hub