Apache Airflow CVE-2026-50204

Requires an authenticated Airflow account that has been granted read access to the event-log / audit API (the Log model's extra field); the account does NOT need prior access to the target Connection or Variable. The deployment must be running Apache Airflow before 3.4.0 and must have had Connection/Variable secret values pass through operations that wrote them to audit Log.extra with non-matching key names (secrets stored under key names outside the configured sensitive-key list are the ones exposed). Limiting factors: exploitation is gated on valid authentication plus audit-API read permission, so environments that restrict audit/event-log read access to administrators materially reduce exposure; there is no remote unauthenticated path and no code execution.

This is a credible but moderate-priority information-disclosure issue, not a high-urgency emergency. No CVSS vector, EPSS score, KEV listing, or SSVC decision is supplied - the vuln.today Decision label is explicitly 'awaiting_data' - so several key scoring signals are missing and cannot be cross-referenced; the vendor rates it 'moderate'. Exploitation requires an already-authenticated low-privilege Airflow user with read access to the event-log/audit API, which caps blast radius to insiders or attackers who have already obtained a foothold account rather than anonymous internet attackers. The real impact is meaningful: the flaw lets such a user recover Connection and Variable secrets (credentials to downstream databases, cloud accounts, APIs) verbatim, including for resources they were never granted, so it enables privilege escalation and lateral movement via harvested third-party credentials. No KEV entry and no public exploit are present in the input, and no EPSS probability is given, so there is no evidence of active or widespread exploitation at time of analysis. Net: prioritize patching where Airflow holds sensitive connection secrets and audit-API read access is broadly granted, but treat it as a post-authentication secret-leak rather than a remote-unauthenticated critical.

An authenticated low-privilege Airflow user who has been granted read access to the event-log/audit API queries audit rows and reads the Log.extra column, which recorded Connection and Variable values in cleartext because the masker only matched configured sensitive key names. Without ever having direct access to those connections or variables, the user recovers the raw credentials and can reuse them against downstream systems. No public exploit is identified in the input; exploitation needs no special tooling, only read access to the audit API.