Apache Airflow: Config API exposes secrets-backend kwargs overrides unmasked, leaking Vault credentials

Impact

Per-key secrets-backend overrides supplied as environment variables such as AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID surface in the Config API as synthetic options whose names are not in sensitive_config_values, so the masker leaves them alone. An authenticated user with Config read permission reads the secrets-backend credentials themselves - Vault role_id and secret_id, for example - which is the key to every other secret the deployment stores. That is a privilege jump from a read-only Airflow role to the credential store backing the whole orchestration layer, including whatever cluster and storage credentials the GPU pipelines use. This is a different masker gap from CVE-2026-48828, in a different API.

Who can reach it

Network access to the Airflow UI or REST API as an authenticated user with Config read permission, on a deployment that exposes the Config API and configures its secrets backend via per-key environment overrides.

What to do

Upgrade to apache-airflow 3.3.0 or later and restart the API server. Then rotate the secrets-backend credentials themselves - a Vault AppRole secret_id that was readable must be assumed burned - and consider disabling Config API exposure (expose_config) as a standing hardening step. Note that 3.3.0 does not close the team-scoped variant tracked as CVE-2026-65017.

References

Related entries

• Apache Airflow: Dag source endpoint returns the whole file, exposing co-located Dags the caller cannot readCVE-2026-49296 · Apache Airflow (Dag source endpoint, GET /api/v2/dagSources/{dag_id})Medium
• Apache Airflow: task-instance API returns deferred trigger kwargs unmasked, exposing secrets passed to triggersCVE-2026-49487 · Apache Airflow (REST API task-instance endpoints, deferred trigger kwargs)Medium
• Dell OpenManage Server Administrator (relative path traversal): A low-privileged remote attacker reads arbitrary filesCVE-2026-56794 · Dell OpenManage Server Administrator (relative path traversal)Medium
• Apache Airflow: JSON Variable secrets shown in cleartext in the Rendered Templates viewCVE-2026-59244 · Apache Airflow secrets masker (Rendered Templates view, var.json dict values)Medium
• Apache Airflow: masker misses team-prefixed config sections, exposing team Celery broker URLs with credentialsCVE-2026-65017 · Apache Airflow (secrets masker, team-scoped config sections in multi-team mode)Medium
• Airflow Google provider: team scope dropped in Secret Manager backend, so one team resolves another's credentialsCVE-2026-68868 · Apache Airflow Google provider (Google Cloud Secret Manager secrets backend, team scoping)Medium