# CVE-2026-50204: Apache Airflow secrets exposure in audit log

Source: https://junglewise.ai/threats/cve-2026-50204-apache-airflow-s-audit-log-stored-connection-and-variable-secret  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-50204 · Severity: info · Published 2026-11-09

Apache Airflow, a workflow orchestration platform, stored database connection credentials and variable secrets in cleartext in its audit logs. An authenticated user with read access to the audit API could retrieve these credentials without needing prior access to the connections or variables themselves, potentially exposing database passwords and API keys used by the platform.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-50204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50204 being exploited in the wild.

**How severe is CVE-2026-50204?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Airflow prior to 3.4.0.

**Is there a fix for CVE-2026-50204?** Yes: fixed in Apache Airflow 3.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50204 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50204?** Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache Airflow 3.4.0

## Technical details

The vulnerability stems from the secrets masker in Airflow's action_logging module selectively masking connection and variable values based on whether field key names matched a configured sensitive-key list, allowing values under non-standard keys to be written verbatim to the Log.extra column. An authenticated low-privilege user with read access to the event-log or audit API could query these unmasked audit rows and recover connection credentials and variable values. The fix masks all connection extra field values and unconditionally masks variable values in audit logs, restricting access to authorized users only.

## Affected products

- Apache Airflow prior to 3.4.0

## Timeline

- 2026-11-09: disclosed

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/68049](https://github.com/apache/airflow/pull/68049)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)