Executive brief
Apache Airflow, a platform used to schedule and monitor workflows, contains a vulnerability that can expose sensitive credentials like passwords and API keys. When workflow templates contain large amounts of data, the system's security masking fails to hide secrets nested within JSON structures. An authorized user with access to view task details could see these secrets in plain text, potentially leading to unauthorized access to connected business systems.
Technical details
A vulnerability in Apache Airflow's rendered-template field handling occurs when a field exceeds the '[core] max_templated_field_length' configuration. In these cases, Airflow stringifies the JSON structure before applying redaction, which causes the masking logic to lose context for nested sensitive keys (e.g., 'password', 'token', 'api_key'). Consequently, these secrets are persisted in plaintext within 'rendered_fields'. An authenticated attacker with UI or API permissions to read rendered template fields can harvest these secrets. This issue is a variant of CWE-200 and is fixed in version 3.2.2.
Affected products
- Apache Software Foundation Apache Airflow < 3.2.2
Timeline
- 2026-04-26: other: Pull request submitted to fix the issue
- 2026-05-18: patched: Fix merged into main branch
- 2026-06-01: disclosed: CVE-2026-42360 published
- 2026-06-01: advisory: GitHub Advisory GHSA-cg3x-89rc-x9mw published