{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/airflow--3.4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-86468"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Airflow (\u003c 3.4.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Airflow versions prior to 3.4.0 contain a vulnerability where the CLI audit logging mechanism incorrectly handles secret masking. Certain CLI command shapes, specifically those utilizing \u003ccode\u003e--conn-extra\u003c/code\u003e, variable descriptions, and the inline \u003ccode\u003e--password\u003c/code\u003e flag in \u003ccode\u003eairflow keycloak-auth-manager\u003c/code\u003e, result in sensitive values being recorded in cleartext within audit logs. An authenticated user with permissions to read audit event logs may extract these secrets.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExposure of plaintext credentials and sensitive configuration data stored in the Airflow audit logs, potentially leading to unauthorized access to connected services or further lateral movement within the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Airflow to version 3.4.0 or later immediately to apply the corrected CLI masking logic.\u003c/li\u003e\n\u003cli\u003eAudit existing audit log stores for historical exposure of secret values referenced in the vulnerability (e.g., searches for \u003ccode\u003e--conn-extra\u003c/code\u003e or \u003ccode\u003e--password\u003c/code\u003e followed by high-entropy strings).\u003c/li\u003e\n\u003cli\u003eRestrict access to Airflow audit logs to only highly privileged administrators to minimize the impact of the exposure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T09:14:06Z","date_published":"2026-11-09T09:14:06Z","id":"https://feed.craftedsignal.io/briefs/2026-11-airflow-secret-exposure/","summary":"Apache Airflow versions prior to 3.4.0 fail to mask secrets in CLI audit logs when using specific command arguments, allowing unauthorized access to plaintext credentials.","title":"Apache Airflow: CLI command argument masking failure (CVE-2026-86468)","url":"https://feed.craftedsignal.io/briefs/2026-11-airflow-secret-exposure/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-111452"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Airflow (\u003c 3.4.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Airflow's secrets masker implementation contains a flaw where it only identifies sensitive key names in their snake_case format. Consequently, sensitive data stored under camelCase keys - specifically \u003ccode\u003eprivateKey\u003c/code\u003e, \u003ccode\u003econnectionString\u003c/code\u003e, \u003ccode\u003ewebhookUrl\u003c/code\u003e, or \u003ccode\u003eaccessKey\u003c/code\u003e - are not properly redacted when appearing in task logs, rendered template fields, or API responses. This exposure impacts users who have access to view task logs or variables.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAuthorized users with read access to task logs, template fields, or API responses may be able to view plaintext secrets that were intended to be masked by the system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Airflow to version 3.4.0 or later to address the secrets masking logic flaw.\u003c/li\u003e\n\u003cli\u003eAudit existing Connection extras and Variables to identify if any sensitive data is currently stored under camelCase keys.\u003c/li\u003e\n\u003cli\u003eReview access control policies for task logs and API endpoints to ensure that only authorized personnel can view sensitive workflow metadata.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T09:13:26Z","date_published":"2026-11-09T09:13:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-09-airflow-secrets-masker-436c359e/","summary":"Apache Airflow versions prior to 3.4.0 fail to redact sensitive information in task logs, templates, and API responses when keys are formatted in camelCase, potentially exposing secrets to authorized users.","title":"Apache Airflow: Sensitive information exposure via unmasked camelCase keys (CVE-2026-111452)","url":"https://feed.craftedsignal.io/briefs/2026-11-09-airflow-secrets-masker-436c359e/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-113504"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Airflow (\u003c 3.4.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache Software Foundation"],"content_html":"\u003cp\u003eApache Airflow contains a vulnerability in its secrets masker mechanism (CVE-2026-113504). The masker performs a depth-limited traversal, stopping after five levels of nested data structures. If a registered secret (such as a connection password or variable) resides deeper than five containers, the masker fails to redact it. This results in the secret appearing in cleartext within task logs and rendered template fields, which are accessible to users with task-log read permissions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized users with access to view Airflow task logs or rendered templates to obtain sensitive credentials (e.g., database passwords, API keys) stored as Connections or Variables if those secrets are programmatically nested within deep data structures.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Airflow to version 3.4.0 or later immediately to resolve the masker depth limitation.\u003c/li\u003e\n\u003cli\u003eAudit existing DAGs and custom operator implementations to identify deeply nested data structures passing sensitive information.\u003c/li\u003e\n\u003cli\u003eRestrict access to task logs and template rendering to only authorized users until patching is complete.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T09:13:21Z","date_published":"2026-11-09T09:13:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-airflow-secrets-masker/","summary":"Apache Airflow versions prior to 3.4.0 fail to mask secrets nested deeper than five levels, potentially exposing sensitive data in plain text within task logs and rendered templates.","title":"Apache Airflow: Secrets masker cleartext exposure (CVE-2026-113504)","url":"https://feed.craftedsignal.io/briefs/2026-11-airflow-secrets-masker/"}],"language":"en","title":"CraftedSignal Threat Feed - Airflow (\u003c 3.4.0)","version":"https://jsonfeed.org/version/1.1"}