Executive brief
Apache Airflow's REST API endpoints for task instances inadvertently exposed sensitive credentials (such as API keys and tokens) that were passed to deferred tasks. Any user with read access to task instances in a specific workflow could extract these secrets in plain text before the task completed. This vulnerability was resolved by removing the exposed fields entirely in version 3.3.0.
Technical details
The vulnerability is an information disclosure (CWE-200) in Apache Airflow's REST API implementation. The task-instance detail and list endpoints returned the full, unmasked trigger kwargs object for deferred tasks. These kwargs contain sensitive data—such as API keys, authentication tokens, and credentials—that operators pass to their triggers at runtime. An authenticated attacker with DAG-scoped read access to task instances could call these REST endpoints and extract plaintext secrets while the task was in a deferred state. The attack requires valid authentication and network access to the Airflow API (AV:N, PR:L). The fix in version 3.3.0 removes the `kwargs` field from the `TriggerResponse` entirely, preventing exposure without affecting trigger execution, as the triggerer still decrypts and uses real kwargs at runtime.
Affected products
- Apache Airflow < 3.3.0
Timeline
- 2026-07-07: disclosed
- 2026-07-07: patched: Apache Airflow 3.3.0 released with fix
References
- https://github.com/apache/airflow/pull/67868
- https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4
- http://www.openwall.com/lists/oss-security/2026/07/07/6
- https://github.com/apache/airflow/commit/9101aa66754af052ba5010a5fce9f8fa4140e6c7
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2088.yaml