Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were
    retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables
    with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0
    that has the fix implemented (CVE-2026-32690)

ID	Name	Product	Family	Type	Severity
458735	Echo: apache-airflow-core: security update to 3.2.0	Tenable Cloud Security	Echo Local Security Checks	Local	low
458735	Echo: apache-airflow-core: security update to 3.2.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
440737	SCA: security update for apache-airflow-core (GHSA-w9r4-94fj-xp69)	Tenable Cloud Security	SCA Checks	Local	low
440737	SCA: security update for apache-airflow-core (GHSA-w9r4-94fj-xp69)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-32690

low

Tenable Plugins

low

low

low

low