CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

CVE-2026-68970

The apache-airflow-task-sdk is vulnerable to Cleartext Storage of Sensitive Information due to improper masking of Variable contents. When a JSON value is a list at the top level, the Task SDK fails to mask it, as masking was only implemented for strings and dictionaries. This allows any authenti...