Is CVE-2026-54183 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54183 being exploited in the wild.

How severe is CVE-2026-54183?

Medium severity, with a CVSS score of 4.3, published 12 August 2026.

Which products and versions are affected?

Apache Airflow before 3.3.1; apache-airflow (PyPI) < 3.3.1, ECOSYSTEM:introduced=0,fixed=3.3.1.

Is there a fix for CVE-2026-54183?

Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54183 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54183?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54183: Apache Airflow secrets masker bypass in UI display

Q: Is there a fix for CVE-2026-54183?

Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54183 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54183?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54183 · Severity: medium · CVSS 4.3 · Published 2026-08-12

Apache Airflow's UI uses a secrets masker to hide sensitive values from shoulder-surfing when displaying Variables. Due to a recursion-depth limitation, deeply nested sensitive values stored within lists, tuples, or sets were displayed unmasked in the Variables UI. An authenticated user viewing the UI could see sensitive data that should have been redacted for visual protection, though the data remains accessible through the REST API to authenticated users.

Technologies: Apache Airflow, apache-airflow (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2026-54183 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54183 being exploited in the wild.
How severe is CVE-2026-54183?: Medium severity, with a CVSS score of 4.3, published 12 August 2026.
Which products and versions are affected?: Apache Airflow before 3.3.1; apache-airflow (PyPI) < 3.3.1, ECOSYSTEM:introduced=0,fixed=3.3.1.
Is there a fix for CVE-2026-54183?: Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54183 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54183?: Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 3.3.1 or later
```
pip install "apache-airflow>=3.3.1"
```

Technical details

The vulnerability is an incomplete fix to CVE-2026-42358. The secrets masker walks dictionary structures unconditionally to find and redact sensitive key names at any depth, but lists, tuples, and sets beyond the recursion-depth limit were not traversed for key-name redaction. An attacker can view unmasked sensitive values in the Variables UI by nesting them inside iterables (lists, tuples, sets) deeper than the MAX_RECURSION_DEPTH threshold. The attack vector requires authentication and UI access; the exposure is limited to visual masking and does not bypass access controls since authenticated users can already retrieve the same data via the REST API. The fix involves walking nested iterables unconditionally for key-name redaction while maintaining the depth cutoff only for pattern-based string masking.

Affected products

Apache Airflow before 3.3.1

Identifiers

CVE-2026-54183
BIT-AIRFLOW-2026-54183
GHSA-g4qj-5vxv-wggf
PYSEC-2026-3705

Timeline

2026-08-12: disclosed
2026-06-25: patched: Fix merged in PR #68422

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.