What is the CVSS score of EUVD-2026-57310?

EUVD-2026-57310 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-57310?

Yes, a patch is available for EUVD-2026-57310. Update the affected software to the latest version immediately.

Apache Airflow EUVD-2026-57310

| CVE-2026-54183 MEDIUM

Information Exposure (CWE-200)

2026-08-12 apache

GHSA-g4qj-5vxv-wggf

Apache Information Disclosure Apache Airflow Apache Software Foundation

4.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

4.3 LOW

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L because authenticated access is required; C:L because the same data is already API-accessible to the same user, so UI exposure adds only marginal confidentiality risk.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 12, 2026 - 17:22 NVD

4.3 (MEDIUM)

Source Code Evidence Fetched

Aug 12, 2026 - 16:28 vuln.today

Analysis Generated

Aug 12, 2026 - 16:28 vuln.today

CVE Published

Aug 12, 2026 - 15:34 cve.org

LOW

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

463 pypi packages depend on apache-airflow (430 direct, 37 indirect)

Ecosystem-wide dependent count for version 3.3.1.

DescriptionCVE.org

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain - the masking is a shoulder-surfing defense for the UI, not an access-control boundary.

This is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.

AnalysisAI

Sensitive values stored as deeply nested lists, tuples, or sets in Apache Airflow Variables are displayed unmasked in the Variables UI due to a recursion-depth logic error in the secrets masker. This is an incomplete-fix follow-up to CVE-2026-42358: that prior fix made dictionary traversal unbounded but left list/tuple/set structures subject to the depth cutoff, allowing values beyond that depth to appear in plaintext on screen. The practical impact is narrow - any authenticated user who can see the Variable in the UI already has read access to the full value through the Variables REST API - making this a shoulder-surfing defense gap rather than an access-control bypass. No public exploit has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the _redact method of airflow_shared/secrets_masker/secrets_masker.py (CPE: cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:*). The secrets masker walks nested data structures recursively and applies a max_depth cutoff intended to bound pattern-based string masking work. The fix for CVE-2026-42358 removed the depth cap for dictionary traversal but left the list/tuple/set traversal block positioned after the depth check, so those container types beyond the depth limit fell through to unmasked display. The PR diff (GitHub #68422) shows the corrective logic moving list/tuple/set traversal before the depth guard, mirroring the unbounded dict walk: sensitive keys within iterables at any nesting depth now always trigger redaction. Root cause per CWE-200 is exposure of sensitive information to an authorized actor through an incomplete masking algorithm, not a missing access-control boundary.

RemediationAI

Upgrade to Apache Airflow 3.3.1 or later, which moves list/tuple/set traversal to before the recursion depth check so nested sensitive values are redacted at any depth in the UI. The patch is available in GitHub PR #68422 (https://github.com/apache/airflow/pull/68422) and documented in the Apache advisory at https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo. As a compensating control prior to patching, administrators can avoid storing secrets as deeply nested list, tuple, or set structures in Airflow Variables - flattening the nesting to within the masker's default depth limit ensures values are redacted in the current release. More importantly, tightening REST API RBAC to restrict which authenticated users can read Variables at all is a stronger control than relying on UI masking; since the UI and API expose the same data to the same permission set, API-level access restrictions address both exposure surfaces simultaneously.