Executive brief
Apache Airflow is a platform used to programmatically author, schedule, and monitor workflows. A vulnerability exists where sensitive information, such as passwords or API keys, stored within JSON-formatted variables is not properly hidden when viewed by users. This could lead to the accidental exposure of credentials to individuals who have access to view variables but should not see the underlying secrets.
Technical details
A vulnerability in Apache Airflow's variable redaction mechanism fails to mask secrets when they are stored as nested fields within JSON dictionaries. The root cause is an insufficient redaction depth setting when processing Variable objects, which allows nested sensitive values to remain in plaintext when retrieved via the API or UI. An attacker with network access to the Airflow interface or API could potentially view these unmasked secrets if they have permissions to retrieve variables. The issue is fixed in version 3.2.0 by implementing a default maximum depth for redaction.
Affected products
- Apache apache-airflow-core >= 3.0.0, < 3.2.0
- Apache apache-airflow >= 3.0.0, < 3.2.0
Timeline
- 2026-03-13: patched: Pull request merged into main branch
- 2026-04-18: disclosed: Initial advisory publication
- 2026-04-18: advisory: GitHub Advisory published