Detections
Analytics

Echo: apache-airflow: security update to 3.2.2

medium Tenable Self-Hosted Container Security Plugin ID 457082

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g.
 nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed
 when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure
 before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`.
 An authenticated UI/API user with permission to read rendered template fields could harvest secret values
 intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested
 sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered
 `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist.
 Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or
 later to cover the nested-key path. (CVE-2026-42360)

Solution

Update the apache-airflow library and its related packages to version 3.2.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-42360

Plugin Details

Severity: Medium

ID: 457082

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-42360

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/11/2026

Vulnerability Publication Date: 6/1/2026

Reference Information

CVE: CVE-2026-42360