CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68969

Summary: Apache Airflow is vulnerable due to audit-log exposure of secrets via bulk endpoints. When submitting Variables or Connections through PATCH /api/v2/variables and PATCH /api/v2/connections, values are written to the audit log in cleartext because the current masking only covers top-level...