CVE-2026-31987

—

CVSS 3.1

7.5 high

EPSS

<1%p52

Published

Apr 16, 2026 (Apr 16, 2026)

Modified

Jun 17, 2026

Description

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Vendors: apache
Products: airflow
Weakness: CWE-532
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.