Apache Airflow: Sensitive information exposure via unmasked camelCase keys (CVE-2026-111452)

Apache Airflow's secrets masker implementation contains a flaw where it only identifies sensitive key names in their snake_case format. Consequently, sensitive data stored under camelCase keys - specifically privateKey, connectionString, webhookUrl, or accessKey - are not properly redacted when appearing in task logs, rendered template fields, or API responses. This exposure impacts users who have access to view task logs or variables.

Impact

Authorized users with read access to task logs, template fields, or API responses may be able to view plaintext secrets that were intended to be masked by the system.

Recommendation

• Upgrade Apache Airflow to version 3.4.0 or later to address the secrets masking logic flaw.
• Audit existing Connection extras and Variables to identify if any sensitive data is currently stored under camelCase keys.
• Review access control policies for task logs and API endpoints to ensure that only authorized personnel can view sensitive workflow metadata.