EUVD-2026-57316
GHSA-f643-3rc2-j27w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible web UI requires an authenticated low-privileged user; impact is solely high confidentiality loss with no integrity or availability effect.
Primary rating from Vendor (apache).
CVSS VectorNVD
Lifecycle Timeline
4Blast Radius
ecosystem impact- 463 pypi packages depend on apache-airflow (430 direct, 37 indirect)
Ecosystem-wide dependent count for version 3.3.1.
DescriptionNVD
Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI - the dict value failed an isinstance(str) guard - so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
AnalysisAI
Secret exposure in Apache Airflow's Rendered Templates UI allows any authenticated user with task-level view access to read plaintext credential values that should have been masked. The secrets masker's isinstance(str) guard silently skips dict-typed Python objects, meaning JSON Variables accessed via var.json and containing dict payloads (e.g., database credentials, API keys stored as structured JSON) are rendered in cleartext rather than redacted. No public exploit is identified at time of analysis; however, the disclosure requires nothing more than standard UI navigation by a legitimately authenticated user.
Technical ContextAI
Apache Airflow allows DAG authors to reference stored Variables in task templates using two accessors: var.value (returns raw string) and var.json (deserializes stored JSON). The secrets masking subsystem in task-sdk/src/airflow/sdk/execution_time/context.py is responsible for redacting sensitive values from logs and UI surfaces via mask_secret(). The defect, classified as CWE-312 (Cleartext Storage of Sensitive Information), resided in both the supervisor-comms path and the SecretCache hit path: after JSON deserialization, mask_secret() was called only inside an isinstance(var_val, str) conditional. When a Variable's JSON deserializes to a Python dict, that branch is never entered, and neither the raw JSON string nor the dict's sensitive field values are registered with the masker. The fix introduces _mask_and_deserialize_variable(), which unconditionally masks the raw JSON string before deserialization and then dispatches masking for both str and dict post-deserialization types. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:*, covering the broad pre-3.3.1 version range.
RemediationAI
Upgrade to Apache Airflow 3.3.1 or later, the vendor-confirmed fixed release. The patch introduces _mask_and_deserialize_variable() in task-sdk/src/airflow/sdk/execution_time/context.py, which correctly registers both the raw JSON string and any dict-typed deserialized value with the secrets masker. The advisory is at https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6. If immediate upgrade is not feasible, the most effective compensating control is to migrate sensitive credentials from JSON (dict-typed) Airflow Variables to a dedicated secrets backend (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager), which Airflow natively supports and which bypasses the Variable accessor entirely. A secondary control is to audit and restrict the Rendered Templates view permission to the minimum set of users who operationally require it, using Airflow's role-based access control - this reduces exposure surface but does not eliminate the disclosure for those users. Note that the upstream fix is confirmed merged in PR #68975 and targeted for the 3.3.1 release; independently verify your installed package version includes this commit before treating patching as complete.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today