Apache Airflow: CLI command argument masking failure (CVE-2026-86468)

Apache Airflow versions prior to 3.4.0 contain a vulnerability where the CLI audit logging mechanism incorrectly handles secret masking. Certain CLI command shapes, specifically those utilizing --conn-extra, variable descriptions, and the inline --password flag in airflow keycloak-auth-manager, result in sensitive values being recorded in cleartext within audit logs. An authenticated user with permissions to read audit event logs may extract these secrets.

Impact

Exposure of plaintext credentials and sensitive configuration data stored in the Airflow audit logs, potentially leading to unauthorized access to connected services or further lateral movement within the environment.

Recommendation

• Upgrade Apache Airflow to version 3.4.0 or later immediately to apply the corrected CLI masking logic.
• Audit existing audit log stores for historical exposure of secret values referenced in the vulnerability (e.g., searches for --conn-extra or --password followed by high-entropy strings).
• Restrict access to Airflow audit logs to only highly privileged administrators to minimize the impact of the exposure.