{"schema_version": "1.6.1", "id": "CVE-2026-59244", "summary": "Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI", "details": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "3.3.1"}]}]}], "references": [{"type": "WEB", "url": "https://github.com/apache/airflow/pull/68975"}, {"type": "WEB", "url": "https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6"}]}