{"action":"Upgrade apache-airflow to 3.3.1 or later.","affected":[{"fixed":"3.3.1","introduced":"3.3.0"}],"component":"apache-airflow","cve_ids":["CVE-2026-65017"],"ecosystem":"PyPI","epss":0.00388,"exploited":false,"fixed_versions":["3.3.1"],"ghsa_id":"GHSA-c56v-8w4g-3mfm","id":"tcs_01M5KH94M0FR5KZJDPQ7AWHMVG","modified_at":"2026-10-15T14:45:07.366644445Z","published_at":"2026-08-12T16:17:12.577Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3993","https://www.cve.org/CVERecord?id=CVE-2026-48828","https://www.cve.org/CVERecord?id=CVE-2026-48892","https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38","https://github.com/apache/airflow/pull/70755","https://github.com/advisories/GHSA-c56v-8w4g-3mfm"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-3993","url":"https://osv.dev/vulnerability/PYSEC-2026-3993"}],"summary":"Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenti"}