Airflow (< 3.4.0) - CraftedSignal Threat Feed

Apache Airflow: CLI command argument masking failure (CVE-2026-86468)

hello@craftedsignal.io — Mon, 09 Nov 2026 09:14:06 +0000

Apache Airflow versions prior to 3.4.0 contain a vulnerability where the CLI audit logging mechanism incorrectly handles secret masking. Certain CLI command shapes, specifically those utilizing --conn-extra, variable descriptions, and the inline --password flag in airflow keycloak-auth-manager, result in sensitive values being recorded in cleartext within audit logs. An authenticated user with permissions to read audit event logs may extract these secrets.

Impact

Exposure of plaintext credentials and sensitive configuration data stored in the Airflow audit logs, potentially leading to unauthorized access to connected services or further lateral movement within the environment.

Recommendation

Upgrade Apache Airflow to version 3.4.0 or later immediately to apply the corrected CLI masking logic.
Audit existing audit log stores for historical exposure of secret values referenced in the vulnerability (e.g., searches for --conn-extra or --password followed by high-entropy strings).
Restrict access to Airflow audit logs to only highly privileged administrators to minimize the impact of the exposure.

Apache Airflow: Sensitive information exposure via unmasked camelCase keys (CVE-2026-111452)

hello@craftedsignal.io — Mon, 09 Nov 2026 09:13:26 +0000

Apache Airflow's secrets masker implementation contains a flaw where it only identifies sensitive key names in their snake_case format. Consequently, sensitive data stored under camelCase keys - specifically privateKey, connectionString, webhookUrl, or accessKey - are not properly redacted when appearing in task logs, rendered template fields, or API responses. This exposure impacts users who have access to view task logs or variables.

Impact

Authorized users with read access to task logs, template fields, or API responses may be able to view plaintext secrets that were intended to be masked by the system.

Recommendation

Upgrade Apache Airflow to version 3.4.0 or later to address the secrets masking logic flaw.
Audit existing Connection extras and Variables to identify if any sensitive data is currently stored under camelCase keys.
Review access control policies for task logs and API endpoints to ensure that only authorized personnel can view sensitive workflow metadata.

Apache Airflow: Secrets masker cleartext exposure (CVE-2026-113504)

hello@craftedsignal.io — Mon, 09 Nov 2026 09:13:21 +0000

Apache Airflow contains a vulnerability in its secrets masker mechanism (CVE-2026-113504). The masker performs a depth-limited traversal, stopping after five levels of nested data structures. If a registered secret (such as a connection password or variable) resides deeper than five containers, the masker fails to redact it. This results in the secret appearing in cleartext within task logs and rendered template fields, which are accessible to users with task-log read permissions.

Impact

Successful exploitation allows unauthorized users with access to view Airflow task logs or rendered templates to obtain sensitive credentials (e.g., database passwords, API keys) stored as Connections or Variables if those secrets are programmatically nested within deep data structures.

Recommendation

Upgrade Apache Airflow to version 3.4.0 or later immediately to resolve the masker depth limitation.
Audit existing DAGs and custom operator implementations to identify deeply nested data structures passing sensitive information.
Restrict access to task logs and template rendering to only authorized users until patching is complete.