CVE-2026-59244

CVE-2026-59244 : Apache Airflow’s secrets masker fails to mask dict-valued var.json Variables in the Rendered Templates UI because the value bypasses an isInstance(str) guard. As a result, a secret stored as a JSON Variable could be shown in cleartext to any user with access to the task’s Rendere...

EUVD-2026-57316

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...