Airflow secrets masker: values under camelCase keys left unredacted in logs and API responses

Impact

The secrets masker only recognizes sensitive key names in snake_case. Values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey, for example in a Connection extra or a Variable, appear in cleartext in task logs, rendered template fields and API responses. Far more people can usually read task logs than can read secrets, so cloud keys and connection strings leak to that wider group.

Who can reach it

Any authenticated user who can read task logs or rendered templates but is not meant to see the credentials.

What to do

Upgrade apache-airflow to 3.4.0 or later and restart schedulers, API servers and workers. Airflow 2.x is affected and end of life with no fix. Purge or restrict task logs that already contain these values, and rotate what they exposed.

References

Related entries

• Airflow: async connection test lets a create-only user overwrite another user's connectionCVE-2026-111455 · Apache Airflow asynchronous connection test (commit_on_success)Unscored
• Airflow secrets masker: secrets nested more than five levels deep shown in cleartextCVE-2026-113504 · Apache Airflow secrets masker (nesting depth limit)Unscored
• Airflow: failed token revocation at logout is ignored, so the token stays validCVE-2026-113508 · Apache Airflow API logout (server-side token revocation)Unscored
• Gitea: Helm chart upload decompresses without a size limit before the quota check, allowing CPU exhaustionCVE-2026-117677 · Gitea (Helm chart package upload)Unscored
• Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor hostCVE-2026-47359 · Apache CloudStack NAS backup provider (addBackupRepository / updateBackupRepository)Unscored
• Apache Airflow: Connection and Variable secrets stored in cleartext in audit log rowsCVE-2026-50204 · Apache Airflow (audit log / event-log API)Unscored