Junglewise Threat Intelligence

CVE-2026-48892: Apache Airflow sensitive information disclosure in Config API

CVE-2026-48892 · Severity: medium · CVSS 6.5 · Published 2026-07-07

Technologies: Apache Airflow, apache-airflow (PyPI). Vendors: Apache, PyPI.

Executive brief

Apache Airflow's Config API failed to mask sensitive secrets-backend credentials when they were configured via per-key environment variable overrides. An authenticated user with Config read permission could retrieve plaintext Vault role IDs, secret IDs, and other secrets-backend credentials through the API. This affects deployments using per-key environment variable configuration for secrets backends, potentially exposing credentials needed to access external secret management systems.

Technical details

The vulnerability is a sensitive information exposure (CWE-200) in Apache Airflow's Config API. Per-key environment variable overrides like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID` are materialized by `conf.as_dict()` as synthetic config options under the `secrets` and `workers` sections (e.g., `backend_kwarg__secret_id`). These synthetic options were not included in the `sensitive_config_values` list, causing the masking/redaction logic to bypass them. An authenticated user with Config read permission could call the Config API endpoints (`GET /config` or `GET /config/section/{section}/option/{option}`) with `display_sensitive=false` and still retrieve unmasked Vault credentials. The fix (merged May 2026, released in apache-airflow 3.3.0) introduces per-key sensitive option detection and masking helpers to properly redact these synthetic options.

Affected products

  • Apache Airflow < 3.3.0

Timeline

  • 2026-07-07: disclosed: CVE-2026-48892 and GHSA-9933-5rrp-mfwx published
  • 2026-05-27: patched: Fix merged in apache/airflow pull request #67622
  • 2026-03-03: patched: Patched version apache-airflow 3.3.0 released (inferred from CVSS date)

References

Related threats