CVE-2026-31987

EUVD-2026-23233
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. 
Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apacheairflow
3.0.0 ≤
𝑥
< 3.2.0
CNA
Common Weakness Enumeration
References
https://github.com/apache/airflow/issues/62428
https://github.com/apache/airflow/issues/62773
https://github.com/apache/airflow/pull/62964
https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g
http://www.openwall.com/lists/oss-security/2026/04/16/7