EUVD-2026-57310
GHSA-g4qj-5vxv-wggf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L because authenticated access is required; C:L because the same data is already API-accessible to the same user, so UI exposure adds only marginal confidentiality risk.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4Blast Radius
ecosystem impact- 462 pypi packages depend on apache-airflow (429 direct, 37 indirect)
Ecosystem-wide dependent count for version 3.3.1.
DescriptionCVE.org
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain - the masking is a shoulder-surfing defense for the UI, not an access-control boundary.
This is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.
AnalysisAI
Sensitive values stored as deeply nested lists, tuples, or sets in Apache Airflow Variables are displayed unmasked in the Variables UI due to a recursion-depth logic error in the secrets masker. This is an incomplete-fix follow-up to CVE-2026-42358: that prior fix made dictionary traversal unbounded but left list/tuple/set structures subject to the depth cutoff, allowing values beyond that depth to appear in plaintext on screen. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: (1) the attacker holds a valid Airflow authenticated session with permission to view the Variables UI - unauthenticated access is not possible; (2) the targeted Variable's value must be structured as a list, tuple, or set nested beyond the secrets masker's recursion depth limit (the PR test cases demonstrate this at depth 6: `a→b→c→d→e→f→[{"password": ...}]`); and (3) the attacker must have physical or remote visual access to the UI screen, since the same data is already programmatically accessible to the same user via the Variables REST API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is materially lower than a typical information-disclosure finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Airflow 3.3.1 or later, which moves list/tuple/set traversal to before the recursion depth check so nested sensitive values are redacted at any depth in the UI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today