EUVD-2026-42029
GHSA-22hf-vx2v-gjff
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST API, low complexity; PR:L because any authenticated user with DAG read access is sufficient; no integrity or availability impact, only secret disclosure.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionCVE.org
In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred. Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API.
AnalysisAI
Apache Airflow REST API exposes provider secrets in plaintext through the task-instance detail and list endpoints when tasks are in a deferred state. Any authenticated user holding DAG-scoped task-instance read access - a permission commonly granted to non-admin roles - can retrieve API keys, passwords, or other secrets passed by deferred operators into trigger kwargs. Fixed in Apache Airflow 3.3.0; no public exploit code identified at time of analysis, though exploitation is trivially achievable by any authenticated user with the requisite read permission.
Technical ContextAI
Apache Airflow's task deferral mechanism allows operators to suspend execution and register a trigger with associated kwargs that are re-evaluated asynchronously. The REST API endpoints for task-instance detail (GET /dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances/{task_id}) and task-instance list did not apply the same secrets-masking logic to the trigger kwargs field that Airflow applies elsewhere (e.g., Variable and Connection values). The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): sensitive data flowed into an API response without sanitization. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:* covering all versions prior to 3.3.0. Provider integrations (e.g., AWS, GCP, Snowflake operators) that use the deferrable operator pattern and forward credentials into trigger kwargs are the primary exposure surface.
RemediationAI
Upgrade to Apache Airflow 3.3.0 or later, which applies secrets masking to trigger kwargs in all task-instance REST API responses. The upstream fix is available via pull request https://github.com/apache/airflow/pull/67868; confirm the patched release is available through your package manager before upgrading. The vendor advisory is at https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4. As a compensating control prior to patching, restrict DAG-scoped task-instance read access to only users who operationally require it, reducing the population of users who could query the affected endpoints. Additionally, audit current Airflow RBAC assignments to identify any users with broad DAG read permissions who do not need them. Rotating any provider API keys or secrets that may have been passed through deferred operator trigger kwargs is advisable as a precaution, particularly in environments where Airflow logs or API responses are accessible to broad user populations.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today