Apache Airflow EUVD-2026-33590

The vulnerability is rooted in the serialization helpers used by two Airflow components: airflow-core/src/airflow/serialization/helpers.py and task-sdk/src/airflow/sdk/execution_time/task_runner.py. Both files implement a serialize_object function that handles rendered template fields. When a template field value - such as a nested dictionary passed via an operator's template_fields (e.g., templates_dict, env_vars) - exceeds the AIRFLOW__CORE__MAX_TEMPLATED_FIELD_LENGTH threshold (default 4096 characters), the truncation code path is triggered. In the vulnerable version, the code called redact(str(serialized), name): the structured Python object was converted to a string first, then passed to the secrets masker. The masker's recursive walker traverses key-value structure to identify sensitive field names, but once the dict is stringified, that structural context is destroyed - the masker sees only the outer field name and cannot recurse into nested keys. The fix, applied in PR #65906, reverses the order to redact(serialized, name), redacting while the value remains a structured object before stringifying the result. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) correctly classifies this root cause: a code path ordering defect causes the masking mechanism to silently fail for nested structures on the truncation path.