https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T10:09:03.021671+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2026-48828 BIT-airflow-2026-48828 — Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key 2026-10-04T10:09:03.100485+00:00

Affected: Bitnami: airflow

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).

 https://cve.radiocsirt.org/vuln/euvd-2026-369560 EUVD-2026-369560 2026-10-04T10:09:03.100544+00:00 EUVD-2026-369560 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48828 fkie_cve-2026-48828 2026-10-04T10:09:03.100561+00:00

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).

 https://cve.radiocsirt.org/vuln/ghsa-563f-2439-rmq4 GHSA-563f-2439-rmq4 — Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API 2026-10-04T10:09:03.100588+00:00

Affected: PyPI: apache-airflow

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).

 https://cve.radiocsirt.org/vuln/pysec-2026-3806 PYSEC-2026-3806 — Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API 2026-10-04T10:09:03.100613+00:00

Affected: PyPI: apache-airflow

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2223 WID-SEC-W-2026-2223 — Apache Airflow: Mehrere Schwachstellen 2026-10-04T10:09:03.100636+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.