Nixpkgs security tracker

Untriaged

Permalink CVE-2026-31987

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

Apache Airflow: JWT token appearing in logs

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

References

https://github.com/apache/airflow/pull/62964 patch
https://github.com/apache/airflow/issues/62428 issue-tracking
https://github.com/apache/airflow/issues/62773 issue-tracking
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g vendor-advisory
http://www.openwall.com/lists/oss-security/2026/04/16/7

Affected products

apache-airflow

<3.2.0

Matching in nixpkgs

pkgs.apache-airflow

Platform to programmatically author, schedule and monitor workflows

nixos-unstable 3.1.7
- nixpkgs-unstable 3.1.7
- nixos-unstable-small 3.1.7
nixos-25.11 2.7.3
- nixos-25.11-small 2.7.3
- nixpkgs-25.11-darwin 2.7.3

Package maintainers

@taranarmo Sergey Volkov <taranarmo@gmail.com>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.apache-airflow

Package maintainers