Apache Airflow: Secrets masker cleartext exposure (CVE-2026-113504)

Apache Airflow contains a vulnerability in its secrets masker mechanism (CVE-2026-113504). The masker performs a depth-limited traversal, stopping after five levels of nested data structures. If a registered secret (such as a connection password or variable) resides deeper than five containers, the masker fails to redact it. This results in the secret appearing in cleartext within task logs and rendered template fields, which are accessible to users with task-log read permissions.

Impact

Successful exploitation allows unauthorized users with access to view Airflow task logs or rendered templates to obtain sensitive credentials (e.g., database passwords, API keys) stored as Connections or Variables if those secrets are programmatically nested within deep data structures.

Recommendation

• Upgrade Apache Airflow to version 3.4.0 or later immediately to resolve the masker depth limitation.
• Audit existing DAGs and custom operator implementations to identify deeply nested data structures passing sensitive information.
• Restrict access to task logs and template rendering to only authorized users until patching is complete.