Executive brief
Apache Airflow, a platform used to programmatically author and monitor workflows, contained a flaw where sensitive information like passwords or API keys could be recorded in plain text within task logs. This occurs when developers use older code paths to hide secrets, which fail to notify the main logging system to mask that data. An attacker with access to the Airflow user interface could view these logs and obtain credentials, potentially leading to unauthorized access to connected business systems.
Technical details
A vulnerability in Apache Airflow (CWE-532) exists where secrets are logged in plain text in the DAG run logs UI. The root cause is a compatibility shim for the 'airflow.sdk.execution_time.secrets_masker' import path, which redirects to a single-process implementation that only masks secrets in the task subprocess. Because the supervisor process responsible for writing logs is not notified of these masking instructions, sensitive strings remain unmasked in the final log output. An authenticated user with low privileges can view these logs via the web interface to extract credentials. The issue is resolved in version 3.2.0 by redirecting the shim to a supervisor-aware implementation.
Affected products
- Apache Airflow >= 3.0.0, < 3.2.0
Timeline
- 2025-11-26: patched: Fix merged into main branch via PR 58662
- 2026-04-13: disclosed: Public disclosure and CVE assignment
- 2026-04-13: advisory