NIXPKGS-2026-1143

GitHub issue published on

Permalink CVE-2026-31987

updated an hour ago by @LeSuisse Activity log

Created automatic suggestion 11 hours ago
@LeSuisse accepted an hour ago
@LeSuisse published on GitHub an hour ago

Apache Airflow: JWT token appearing in logs

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

References

https://github.com/apache/airflow/pull/62964 patch
https://github.com/apache/airflow/issues/62428 issue-tracking
https://github.com/apache/airflow/issues/62773 issue-tracking
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g vendor-advisory
http://www.openwall.com/lists/oss-security/2026/04/16/7

Affected products

apache-airflow

<3.2.0

Matching in nixpkgs

pkgs.apache-airflow

Platform to programmatically author, schedule and monitor workflows

nixos-unstable 3.1.7
- nixpkgs-unstable 3.1.7
- nixos-unstable-small 3.1.7
nixos-25.11 2.7.3
- nixos-25.11-small 2.7.3
- nixpkgs-25.11-darwin 2.7.3

Package maintainers

@taranarmo Sergey Volkov <taranarmo@gmail.com>

Nixpkgs security tracker

Details of issue NIXPKGS-2026-1143

References

Affected products

Matching in nixpkgs

pkgs.apache-airflow

Package maintainers