Executive brief
Apache Airflow's Bulk Variables API failed to properly redact sensitive data stored in JSON variables, even when the variable key names used secret-indicating suffixes (like `_password`, `_token`, or `_secret`). An authenticated user with variable read permissions could retrieve plaintext secrets from JSON variables that should have been hidden. This affects deployments storing sensitive configuration data in Airflow's variable management system.
Technical details
The vulnerability is a sensitive information disclosure (CWE-200) in Apache Airflow's variable redaction logic. The Bulk Variables API calls a redactor function to mask sensitive values based on key-name patterns, but the redactor was invoked without passing the variable's key as a parameter. This caused the `should_hide_value_for_key` check—which looks for secret-suffixed key names (e.g., `*_password`, `*_token`, `*_secret`)—to fail for JSON-decodable variable values. An authenticated API/UI user with bulk variable read permissions can exploit this to retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. The attack requires valid Airflow credentials and bulk variable read permission. The fix was applied in version 3.3.0 (landed after 3.2.2 release); no 3.2.x backport is available.
Affected products
- Apache Airflow < 3.3.0
Timeline
- 2026-07-07: disclosed: Published to GitHub Advisory Database
- 2026-07-07: patched: Patched in version 3.3.0