# CVE-2026-111452: Apache Airflow secrets masker bypass for camelCase keys

Source: https://junglewise.ai/threats/cve-2026-111452-apache-airflow-s-secrets-masker-matched-sensitive-key-names-only  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-111452 · Severity: info · Published 2026-11-09

Apache Airflow is a workflow orchestration platform that manages data pipelines and job scheduling. The secrets masker, which is supposed to redact sensitive credentials in logs and API responses, only recognized credentials stored with snake_case key names. Attackers who could read task logs or API responses could view plaintext credentials like `privateKey`, `connectionString`, or `webhookUrl` that were stored under camelCase naming conventions, potentially gaining unauthorized access to connected systems.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111452 being exploited in the wild.

**How severe is CVE-2026-111452?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Airflow.

**Is there a fix for CVE-2026-111452?** Yes: fixed in apache-airflow 3.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111452 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111452?** Check whether you run Apache Airflow. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in apache-airflow 3.4.0

## Technical details

The secrets masker's key normalization function lowercased keys and replaced non-word characters with underscores, which failed to match camelCase or PascalCase keys against multi-word sensitive field names (e.g., `privateKey` never matched `private_key`). An unauthenticated or unprivileged user with read access to task logs, rendered template fields, or API responses could extract plaintext credentials stored under camelCase keys. The fix adds PascalCase/camelCase boundary splitting during key matching to correctly identify sensitive fields regardless of naming convention.

## Affected products

- Apache Airflow

## Timeline

- 2026-10-16: patched
- 2026-11-09: advisory

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/74840](https://github.com/apache/airflow/pull/74840)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)