CVE-2026-68969

If you patched Apache Airflow to 3.3.0 in response to CVE-2026-50204, you may still be exposed. The original fix addressed audit log masking in single-entity PATCH handlers but missed the bulk endpoints that nest the same values two levels deep under an `items` key. An attacker with audit log read access — a permission often granted broadly to operators, auditors, and support staff — can extract sensitive variable and connection values without holding Variables.read or Connections.read. The audit log read permission was not designed as a security boundary; it was treated as telemetry access, creating a bypass vector that the CVE-2026-50204 patch never addressed because the developer audited the code path they could see, not every path the API surface permitted. What makes this especially dangerous is the blast radius population. The vulnerability only affects users who have audit log access but lack resource access — exactly the separation many deployments enforce for operational staff. The permissions model assumes audit logs contain descriptions of mutations, not copies of mutated data. That assumption predates both CVEs and was never re-audited when bulk endpoints shipped. Check your deployment immediately: verify whether bulk PATCH operations against Variables or Connections are being logged with unmasked values. The fix for CVE-2026-68969 patches the masking gap, but you should independently evaluate whether audit log read should require the same resource-level permissions as direct resource access. The architectural fix would move masking to the audit log write path itself, making it path-agnostic and catching future API shapes automatically — but that refactor may require codebase changes beyond a CVE patch. If you operate Airflow in multi-tenant or otherwise restricted environments, treat this as a priority upgrade. Organizations that deployed 3.3.0 promptly are not over-investigating by re-auditing their audit logs — the original patch closed one branch of the vulnerability class, not the class itself.

Reviewed through automated stages and approved by a human before publication.