Database/Control plane, storage & DevOps
Apache Airflow: oversized rendered template fields bypass user-registered secret masks
Impact
When a rendered template field exceeds [core] max_templated_field_length, Airflow serialized it with a secrets-masker instance that did not carry patterns registered through mask_secret(). Secrets that an operator deliberately taught Airflow to hide are therefore shown in cleartext in the Rendered Templates view. On a shared GPU cluster where DAG authors from several teams can browse each other's task instances, this hands over tokens and keys that were assumed masked. The leak is confined to the UI and to fields long enough to hit the truncation path.
Who can reach it
Any authenticated Airflow user who can view the Rendered Templates page for a task whose templated field exceeds the configured length limit.
What to do
Upgrade to Airflow 3.1.6 or later and restart the API server/webserver and schedulers. Rotate any secret that was displayed through this path, since the values are already in the metadata database and in browser history.
References
Related entries
- Apache Airflow: proxy URLs with embedded credentials are not masked in task logsCVE-2025-68675 · Apache Airflow (Connection proxy fields, log masking)High
- GitLab CE/EE: unauthenticated poisoning of the cached OIDC discovery document redirects auth flowsCVE-2026-112212 · GitLab CE/EE (cached OAuth/OIDC discovery document)High
- IBM Storage Scale GUI (hardcoded inter-node token): A hardcoded token in the Storage Scale GUI source, usedCVE-2026-13460 · IBM Storage Scale GUI (hardcoded inter-node token)High
- Performance Co-Pilot: signed integer overflow in __pmGetPDU permanently blinds the collector daemonCVE-2026-16529 · Performance Co-Pilot pmcd/PMAPI (__pmGetPDU PDU length handling)High
- Apache Airflow: session cookie is set at path=/ regardless of base_url, enabling cross-app takeoverCVE-2026-28779 · Apache Airflow (session cookie `_token` path scope)High
- Apache Airflow: SQL error stack traces returned by the API despite expose_stack_traces=falseCVE-2026-30912 · Apache Airflow API (SQL error handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.