Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Summary
This article describes a security update for the sensitive variables feature in Microsoft Power Automate for desktop. A potential vulnerability (CVE-2026-40374) that can expose sensitive values in flow execution logs affects Power Automate for desktop versions 2.62 through 2.66.
Important
The issue affects only flows that use global sensitive variables in local subflows.
Symptoms
When you mark a variable as sensitive in a desktop flow, its value is usually hidden from flow execution logs on the Power Automate portal. Because of this vulnerability, the value can appear in the logs if a global sensitive variable is used in a local subflow.
Solution
To fix the issue, update Power Automate for desktop to an updated version as soon as possible. Install the latest version of Power Automate for desktop.
If you need an update for an earlier release, get one of the following downloads:
Note
Release 2.67.143.26090 and all later versions include this security fix.