Is CVE-2026-86468 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86468 being exploited in the wild.

How severe is CVE-2026-86468?

Informational severity, published 9 November 2026.

How is CVE-2026-86468 attacked?

It is attacked with local access or from the adjacent network, in a software library.

Am I affected by CVE-2026-86468?

Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86468: Apache Airflow CLI audit log secrets exposure

CVE-2026-86468 · Severity: info · Published 2026-11-09

Apache Airflow's command-line interface writes arguments to audit logs but masks secrets only by their position in the command, so certain command formats leave sensitive information like database passwords and API credentials in plaintext. An attacker with read access to audit logs can extract these exposed secrets even if they lack direct access to variables and connections, potentially compromising databases and external services.

Technologies: Apache Airflow. Vendors: Apache.

Quick answers

Is CVE-2026-86468 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86468 being exploited in the wild.
How severe is CVE-2026-86468?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Apache Airflow before 3.4.0.
Is there a fix for CVE-2026-86468?: Yes: fixed in 3.4.0. Until then: Purge audit log entries (Log.extra rows) written before upgrading to 3.4.0 and rotate any credentials exposed in those entries (database passwords, API tokens, connection URIs). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86468 attacked?: It is attacked with local access or from the adjacent network, in a software library.
Am I affected by CVE-2026-86468?: Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.4.0

Purge audit log entries (Log.extra rows) written before upgrading to 3.4.0 and rotate any credentials exposed in those entries (database passwords, API tokens, connection URIs).

Technical details

The _build_metrics function records sys.argv into the audit log and masks secrets by positional argument, assuming the key-value pair are the final two arguments. Any trailing option (e.g., --description, --serialize-json) displaces them, leaving secrets in cleartext in Log.extra. Additionally, --conn-extra was not masked at all despite being where connection secrets reside, and --conn-json only masked top-level keys, missing nested secrets. The fix shifts from position-based masking to parsing the argument Namespace directly and redacting the actual secret values wherever they appear, handling both long-form and equals-sign syntax (--option=value).

Affected products

Apache Airflow before 3.4.0

Timeline

2026-11-09: disclosed
2026-10-19: patched: PR #72650 merged to main

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.