Airflow secrets masker: secrets nested more than five levels deep shown in cleartext

Impact

The secrets masker stops descending into nested structures after five levels. A registered secret, such as a Connection password or a Variable value, that sits deeper than that under non-sensitive keys appears in cleartext in task logs and rendered template fields. Anyone who can read task logs, usually a much wider group than secret readers, can recover it. This is a different gap from the camelCase key issue (CVE-2026-111452) and has its own fix.

Who can reach it

Any authenticated user who can read task logs or rendered templates but is not meant to see the secrets.

What to do

Upgrade apache-airflow to 3.4.0 or later and restart schedulers, API servers and workers. Airflow 2.x is affected and end of life with no fix. Purge or restrict historical logs that contain these values, and rotate what they exposed.

References

Related entries

• Airflow: failed token revocation at logout is ignored, so the token stays validCVE-2026-113508 · Apache Airflow API logout (server-side token revocation)Unscored
• Gitea: Helm chart upload decompresses without a size limit before the quota check, allowing CPU exhaustionCVE-2026-117677 · Gitea (Helm chart package upload)Unscored
• Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor hostCVE-2026-47359 · Apache CloudStack NAS backup provider (addBackupRepository / updateBackupRepository)Unscored
• Apache Airflow: Connection and Variable secrets stored in cleartext in audit log rowsCVE-2026-50204 · Apache Airflow (audit log / event-log API)Unscored
• DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition): A specification-level defect rather thanCVE-2026-61810 · DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition)Unscored
• Linux x86/mm - broadcast TLB flush with PCID disabled: Booting with nopcid clears the PCID feature but broadcast TLBCVE-2026-64229 · Linux x86/mm - broadcast TLB flush with PCID disabledUnscored