Executive brief
Apache Airflow is a popular workflow orchestration platform used to schedule and monitor data pipelines. A flaw in the secrets masking system allows sensitive JSON variable values to be displayed in cleartext in the Rendered Templates view when accessed by users with task view permissions, potentially exposing credentials and API keys used in pipelines.
Technical details
The vulnerability exists in Apache Airflow's secrets masker component within the Rendered Templates UI. When a Variable is stored as a JSON dictionary and referenced via `var.json` in a task template, the masking logic fails due to an `isinstance(str)` type guard that only masks string values, allowing nested dict values to bypass protection. An authenticated user with access to view a task's Rendered Templates can see the plaintext secret, including credentials and sensitive configuration data. The fix, available in Airflow 3.3.1 and later, masks nested Variable values regardless of their type.
Affected products
- Apache Airflow before 3.3.1
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fix available in Apache Airflow 3.3.1