Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-31987

Fixed upstream EPSS <1%CVSS 7.5

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Published 2026-04-16 · CVE record · OSV

Products: Apache Software Foundation Apache Airflow

Fixed upstream

EcosystemPackageFixed in
PyPIapache-airflow3.2.0