Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

GHSA-phv5-vq5p-qhp7 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceGHSA-phv5-vq5p-qhp7

GHSA-phv5-vq5p-qhp7

HIGH7.5

Apache Airflow: JWT token appearing in logs

Published Apr 16, 2026

Modified 6 months ago

Fix available

Details

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Affected Packages

apache-airflow

PyPI

Fixed in:

3.2.0

References

http://www.openwall.com/lists/oss-security/2026/04/16/7

https://github.com/advisories/GHSA-phv5-vq5p-qhp7

https://github.com/apache/airflow

https://github.com/apache/airflow/issues/62428

https://github.com/apache/airflow/issues/62773

https://github.com/apache/airflow/pull/62964

https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g

https://nvd.nist.gov/vuln/detail/CVE-2026-31987

Aliases

CVSS Analysis

CVSS v4.0

6.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

LowVC:L

Vuln. Integrity

NoneVI:N

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

6.9/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Related

Ecosystems

Timeline

PublishedApr 16, 2026

ModifiedApr 24, 2026