Executive brief
Apache Airflow's audit logging feature inadvertently recorded sensitive information—variable values and database connection credentials—in plaintext when submitted through bulk API endpoints. Any authenticated user with access to the audit log, even without permission to view variables or connections themselves, could recover these secrets. This affects the UI's import function, exposing all secrets from imported files to the audit log permanently.
Technical details
The vulnerability is an information disclosure flaw in Apache Airflow's audit logging mechanism. When bulk API endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`) process requests, the audit-log masking logic fails to redact sensitive fields because entities are nested two levels deep in bulk requests, while the masking logic only checks top-level fields. Connection `extra` contents remain unencrypted in the audit log despite being encrypted in the database. The attack requires network access to Airflow's API and authentication, but no elevated privileges beyond audit-log read access. The Airflow UI's Import Variables feature uses this vulnerable endpoint, automatically exposing imported secrets. A prior fix (CVE-2026-50204) addressed single-entity endpoints only, leaving bulk endpoints unpatched. The fix was merged on 2026-08-03 and shipped in version 3.3.1.
Affected products
- Apache Airflow below 3.3.1
Timeline
- 2026-08-12: disclosed
- 2026-08-03: patched: Fix merged in PR #70890, shipped in Airflow 3.3.1