EUVD-2026-42028
GHSA-563f-2439-rmq4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable API, low complexity, but PR:L because exploitation requires authenticated access with a specific bulk Variable read permission grant; confidentiality fully compromised for affected variables; no integrity or availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based should_hide_value_for_key check (which triggers on secret-suffixed key names like *_password / *_token / *_secret) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to apache-airflow 3.3.0 or later (the fix landed on main after 3.2.2; no 3.2.x backport).
AnalysisAI
Sensitive credential exposure in Apache Airflow's Bulk Variables API allows authenticated users with bulk Variable read permission to retrieve plaintext values from JSON-typed variables whose key names use secret-suffixed conventions such as *_password, *_token, or *_secret. The redactor function was invoked without passing the variable key, so the should_hide_value_for_key check - which is responsible for masking secrets based on key-name patterns - could never fire for JSON-decodable variable values. This affects all deployments prior to 3.3.0 that store sensitive credentials in JSON-typed Airflow Variables under secret-suffixed key names; no public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for authenticated access with a specific permission grant.
Technical ContextAI
Apache Airflow's Variables subsystem provides a key-value store for runtime configuration; values can be stored as plain strings or JSON-encoded objects. The Bulk Variables API endpoint is designed to return multiple variables in a single response. A redactor component is responsible for masking sensitive values before they are returned to callers, using the should_hide_value_for_key function, which pattern-matches variable key names against secret-indicating suffixes (e.g., _password, _token, _secret). The root cause, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), is that the Bulk Variables API invoked the redactor without forwarding the variable's key name. As a result, the key-name pattern check could not execute for JSON-decodable values, and those values were returned in plaintext instead of being redacted. Plain string values are not indicated as affected. The impacted product is identified via CPE cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:*, covering the Apache Software Foundation's Python-based workflow orchestration platform.
RemediationAI
Upgrade to apache-airflow 3.3.0 or later, which contains the fix introduced via pull request https://github.com/apache/airflow/pull/67495. The vendor has confirmed no 3.2.x backport is available, so operators on the 3.2.x series must upgrade to 3.3.0. As an immediate compensating control, review all Airflow Variables that use secret-suffixed key names (e.g., keys ending in _password, _token, or _secret) and migrate their values to Airflow's Secrets Backend (e.g., HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager), which is the recommended long-term practice for storing credentials; this eliminates reliance on the Variables redactor entirely. Additionally, audit and restrict the bulk Variable read permission to only those roles and users that strictly require it, reducing the attack surface until the upgrade is applied. The vendor advisory is available at https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today