Database/Control plane, storage & DevOps
Airflow Task SDK: Variables whose JSON value is a list are not masked in task logs or rendered templates
Impact
Masking is applied only when a deserialized Variable is a string or a dict; a top-level JSON list matches neither and is emitted unmasked. Secrets stored in that shape appear in cleartext in task logs and in the Rendered Templates view, so anyone who can read the logs of a task referencing such a Variable recovers the values - log readers are usually a much wider group than secrets readers. This is the list-shaped counterpart of CVE-2026-59244, which fixed only the dict case, so deployments that upgraded for that advisory remain affected.
Who can reach it
Any authenticated user able to read task logs or rendered templates for a task that references a list-valued Variable. No special configuration required.
What to do
Upgrade apache-airflow to 3.3.1 or later and restart schedulers and workers so the new Task SDK is in use. Also purge or restrict the historical task logs that already contain the values, and rotate anything they exposed.
References
Related entries
- Airflow: asset materialization authorizes the Dag without its team, letting one team trigger another's runsCVE-2026-68971 · Apache Airflow (asset materialize endpoint and wait_dag_run_until_finished XCom check)Medium
- GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium
- Fortra BoKS Manager: oversized digest name in a KSL start message overflows a fixed 16-byte checksum fieldCVE-2026-79900 · Fortra BoKS Manager boks_ksllogsd (KSL start message digest name)Medium
- Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpointsCVE-2026-8045 · Schneider Electric Data Center Expert - SOAP service endpointsMedium
- Dell OpenManage Server Administrator (authorization checks): A second, distinct flaw in the same OMSA versionsCVE-2026-81439 · Dell OpenManage Server Administrator (authorization checks)Medium
- Ansible automation-controller: REST filter oracle on workflow artifacts leaks no_log secrets across organizationsCVE-2026-84720 · Red Hat Ansible Automation Platform automation-controller (REST filter on WorkflowJobNode.ancestor_artifacts)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.