Airflow: bulk Variable and Connection endpoints write secrets to the audit log in cleartext

Impact

Audit-log masking only inspects top-level request fields, but PATCH /api/v2/variables and PATCH /api/v2/connections nest their entities two levels down, so Variable values and Connection extra contents are logged verbatim. Any authenticated user with audit-log read - a role that need not include Variables or Connections read at all - recovers them, and the Connection extra copy sits unencrypted in the log while the connections table encrypts it. The UI's Import Variables action posts to this endpoint, so a routine operator import dumps an entire secrets file into the log. This is a different code path from CVE-2026-50204, whose fix in 3.3.0 covered only the single-entity endpoints, so sites that already upgraded for that advisory are still exposed.

Who can reach it

Any authenticated Airflow user holding audit-log read access. No team boundary or special configuration involved.

What to do

Upgrade apache-airflow to 3.3.1 or later and restart the API server and scheduler. Upgrading alone is not sufficient: purge or restrict the existing audit-log records and rotate every Variable value and Connection extra submitted through a bulk endpoint or the Import Variables UI.

References

Related entries

• Airflow Task SDK: Variables whose JSON value is a list are not masked in task logs or rendered templatesCVE-2026-68970 · Apache Airflow Task SDK (secret masking for list-valued Variables)Medium
• Airflow: asset materialization authorizes the Dag without its team, letting one team trigger another's runsCVE-2026-68971 · Apache Airflow (asset materialize endpoint and wait_dag_run_until_finished XCom check)Medium
• GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium
• Fortra BoKS Manager: oversized digest name in a KSL start message overflows a fixed 16-byte checksum fieldCVE-2026-79900 · Fortra BoKS Manager boks_ksllogsd (KSL start message digest name)Medium
• Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpointsCVE-2026-8045 · Schneider Electric Data Center Expert - SOAP service endpointsMedium
• Dell OpenManage Server Administrator (authorization checks): A second, distinct flaw in the same OMSA versionsCVE-2026-81439 · Dell OpenManage Server Administrator (authorization checks)Medium