Apache Airflow CVE-2026-42358

Exploitation requires an authenticated Airflow account with at minimum DAG trigger privileges or XCom write access, confirmed by CVSS PR:L (low privileges required). The attacker must supply or influence a structured payload containing a sensitive key name recognized by should_hide_value_for_key (specifically: password, token, secret, api_key, and similar) nested at more than five dict levels deep. Cleartext exposure occurs in task logs, rendered template views, or API responses that echo the processed payload. Default Airflow deployments where secrets are stored at shallow nesting depth (four or fewer levels) are not affected by this specific bypass path. Exploitation is bounded entirely to information disclosure - CVSS confirms no integrity or availability impact. The flaw does not allow credential injection or code execution on its own.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-accessible, low-complexity flaw requiring only low-privilege authentication with high confidentiality impact and no integrity or availability consequence. In practice, real-world risk is meaningfully lower than the raw score implies. Exploitation requires the attacker to be an authenticated Airflow user who can supply or influence deeply nested dict payloads - an uncommon pattern for genuine production secrets, which are more typically stored in Airflow's Connections or Variables store at shallow nesting depths. EPSS of 0.02% at the 5th percentile is consistent with a targeted, low-automation flaw. No KEV listing and no public POC further reduce urgency. The primary realistic threat model is insider abuse or post-compromise lateral movement by a low-privilege account attempting to harvest credentials visible in logs. There is no conflict between the CVSS network vector and the description - the API and UI endpoints that accept dag_run.conf are network-accessible, validating AV:N.

An authenticated low-privilege Airflow user triggers a DAG via the REST API, supplying a dag_run.conf body such as {"a": {"b": {"c": {"d": {"e": {"password": "s3cr3t"}}}}}} - six nesting levels deep. Airflow's SecretsMasker processes the rendered template output for logging, but the depth counter exceeds max_depth (5) before reaching the password key, causing the value s3cr3t to be written in cleartext to the task log. The attacker or any user with log-read access can then retrieve the exposed credential. No exploit code beyond a standard Airflow API call is required.