CVE-2026-113504 | BDVDB-2026-402220 Detail

ApacheApache Airflow

Description#

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

References#

https://github.com/apache/airflow/pull/73793
https://lists.apache.org/thread.html/c0bzrpq913qh7srwdmx0smvt1tgvthrr
http://www.openwall.com/lists/oss-security/2026/11/09/19

Exploit#

No public exploit known

History#

Version 12026-11-09Record published in the CVE List.