Apache Airflow: task-instance API returns deferred trigger kwargs unmasked, exposing secrets passed to triggers

Impact

Task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator hands a secret - a provider API key, for instance - to its trigger, that value sits readable in the API for as long as the task is deferred. Any authenticated user with DAG-scoped task-instance read on that DAG can collect it, and deferrable operators are exactly the ones used for long waits on cloud APIs and storage, so the exposure window is hours rather than seconds. The credentials recovered are those of the downstream services the pipeline touches, not Airflow itself.

Who can reach it

Network access to the Airflow REST API as an authenticated user with task-instance read access for the DAG in question.

What to do

Upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs, and restart the API server and triggerer. Rotate any credential known to have been passed into a trigger while an unpatched version was running. Scheduler-side only; no GPU node maintenance.

References

Related entries

• Dell OpenManage Server Administrator (relative path traversal): A low-privileged remote attacker reads arbitrary filesCVE-2026-56794 · Dell OpenManage Server Administrator (relative path traversal)Medium
• Apache Airflow: JSON Variable secrets shown in cleartext in the Rendered Templates viewCVE-2026-59244 · Apache Airflow secrets masker (Rendered Templates view, var.json dict values)Medium
• Apache Airflow: masker misses team-prefixed config sections, exposing team Celery broker URLs with credentialsCVE-2026-65017 · Apache Airflow (secrets masker, team-scoped config sections in multi-team mode)Medium
• Airflow Google provider: team scope dropped in Secret Manager backend, so one team resolves another's credentialsCVE-2026-68868 · Apache Airflow Google provider (Google Cloud Secret Manager secrets backend, team scoping)Medium
• Apache Airflow Yandex provider (Lockbox secrets backend, team-scope lookup): When the team-scoped lookup for aCVE-2026-68871 · Apache Airflow Yandex provider (Lockbox secrets backend, team-scope lookup)Medium
• Airflow Amazon provider: AWS secrets backends fall through to a team-agnostic lookup, leaking other teams' credentialsCVE-2026-68872 · Apache Airflow Amazon provider (SSM Parameter Store / Secrets Manager backends)Medium