Executive brief
Apache Airflow, a platform used to programmatically author and schedule workflows, contains a flaw in how it hides sensitive information like passwords and API keys. When these secrets are stored deep within complex data structures, the system's automatic masking tool fails to redact them, potentially allowing authorized users to view plaintext credentials they should not see. This could lead to unauthorized access to other connected systems or data breaches if an attacker harvests these exposed secrets.
Technical details
A vulnerability in Apache Airflow's SecretsMasker component allows for the exposure of sensitive information when JSON Variables exceed a specific recursion depth. The masker's redaction logic, which triggers on key suffixes like 'password' or 'secret', was found to short-circuit and return original values once the recursion limit was reached, before performing the sensitive key check. This is a residual gap from a previous fix (CVE-2026-32690) that only addressed shallow nesting. An authenticated attacker with Variable read permissions can exploit this by accessing deeply-nested JSON objects via the UI or API to harvest plaintext secrets. The issue is resolved in Apache Airflow version 3.2.2 by ensuring sensitive key checks occur before depth-limit enforcement.
Affected products
- Apache Airflow < 3.2.2
Timeline
- 2026-04-27: other: Pull request submitted to fix the masking logic
- 2026-05-12: patched: Fix merged into main branch
- 2026-06-01: advisory: GitHub and NVD advisories published
- 2026-06-01: disclosed