# CVE-2026-54183: Apache Airflow secrets masker bypass in UI display

Source: https://junglewise.ai/threats/cve-2026-54183-apache-airflow-secrets-masker-bypass-in-ui-display  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54183 · Severity: medium · CVSS 4.3 · Published 2026-08-12

Apache Airflow's UI uses a secrets masker to hide sensitive values from shoulder-surfing when displaying Variables. Due to a recursion-depth limitation, deeply nested sensitive values stored within lists, tuples, or sets were displayed unmasked in the Variables UI. An authenticated user viewing the UI could see sensitive data that should have been redacted for visual protection, though the data remains accessible through the REST API to authenticated users.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow), [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54183 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54183 being exploited in the wild.

**How severe is CVE-2026-54183?** Medium severity, with a CVSS score of 4.3, published 12 August 2026.

**Which products and versions are affected?** Apache Airflow before 3.3.1; apache-airflow (PyPI) < 3.3.1, ECOSYSTEM:introduced=0,fixed=3.3.1.

**Is there a fix for CVE-2026-54183?** Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54183 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54183?** Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-airflow (PyPI): upgrade to 3.3.1 or later

  ```sh
  pip install "apache-airflow>=3.3.1"
  ```


## Technical details

The vulnerability is an incomplete fix to CVE-2026-42358. The secrets masker walks dictionary structures unconditionally to find and redact sensitive key names at any depth, but lists, tuples, and sets beyond the recursion-depth limit were not traversed for key-name redaction. An attacker can view unmasked sensitive values in the Variables UI by nesting them inside iterables (lists, tuples, sets) deeper than the MAX_RECURSION_DEPTH threshold. The attack vector requires authentication and UI access; the exposure is limited to visual masking and does not bypass access controls since authenticated users can already retrieve the same data via the REST API. The fix involves walking nested iterables unconditionally for key-name redaction while maintaining the depth cutoff only for pattern-based string masking.

## Affected products

- Apache Airflow before 3.3.1

## Identifiers

- CVE-2026-54183
- BIT-AIRFLOW-2026-54183
- GHSA-g4qj-5vxv-wggf
- PYSEC-2026-3705

## Timeline

- 2026-08-12: disclosed
- 2026-06-25: patched: Fix merged in PR #68422

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/68422](https://github.com/apache/airflow/pull/68422)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)