https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T19:05:11.217416+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2026-42360 BIT-airflow-2026-42360 — Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking 2026-10-04T19:05:11.221874+00:00

Affected: Bitnami: airflow

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the nested-key path.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-qq72344 CLEANSTART-2026-QQ72344 — Security fix for CVE-2026-42360 applied in: airflow-3 3.2.1-r9 2026-10-04T19:05:11.221936+00:00

Affected: CleanStart: airflow-3

Security vulnerability affects the airflow-3 package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-323359 EUVD-2026-323359 2026-10-04T19:05:11.221960+00:00 EUVD-2026-323359 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42360 fkie_cve-2026-42360 2026-10-04T19:05:11.221974+00:00

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the nested-key path.

 https://cve.radiocsirt.org/vuln/ghsa-cg3x-89rc-x9mw GHSA-cg3x-89rc-x9mw — Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor 2026-10-04T19:05:11.222001+00:00

Affected: PyPI: apache-airflow

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the nested-key path.

 https://cve.radiocsirt.org/vuln/pysec-2026-172 PYSEC-2026-172 2026-10-04T19:05:11.222027+00:00

Affected: PyPI: apache-airflow

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the nested-key path.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1761 WID-SEC-W-2026-1761 — Apache Airflow: Mehrere Schwachstellen 2026-10-04T19:05:11.222050+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.