--- cve: "CVE-2026-68969" severity: "MEDIUM" cvss: 6.5 epss: "36%" vendor: "Apache Software Foundation" kev: false exploited: false published: "2026-08-12 16:17:19" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-19T08:44:06+02:00" --- # CVE-2026-68969 > 6.5 MEDIUM · 🧪 PoC ## Beschreibung Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Gering | warn | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Hoch | bad | | I Integrität | Keine | good | | A Verfügbarkeit | Keine | good | ## Patch verfügbar (OSV) - 275ac7303fa702e232c277ac7f4929baa85464d2 (Commit) ## Referenzen - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-68969) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_