Detections
Analytics

Echo: apache-airflow: security update to 3.2.2

medium Tenable Cloud Security Plugin ID 462627

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-
 suffixed key names like `password`, `token`, `secret`, `api_key`) to be bypassed when the JSON value's
 nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original
 nested item before checking the sensitive key name. An authenticated UI/API user with Variable read
 permission could harvest plaintext secret values stored under sensitive keys nested deep enough to exceed
 the masker's depth cap. Affects deployments that store sensitive values inside deeply-nested JSON
 Variables. This is a residual gap in the fix for CVE-2026-32690 (which covered shallower nesting via
 `max_depth=1`); the depth-limit boundary itself was not raised, so the same key-name bypass pattern
 reappears beyond the recursion cap. Users who already upgraded for CVE-2026-32690 should additionally
 upgrade to `apache-airflow` 3.2.2 or later to cover the deep-nesting path. (CVE-2026-42358)

Solution

Update the apache-airflow library and its related packages to version 3.2.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-42358

Plugin Details

Severity: Medium

ID: 462627

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-42358

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/11/2026

Vulnerability Publication Date: 6/1/2026

Reference Information

CVE: CVE-2026-42358