Database/Control plane, storage & DevOps
Apache Airflow CLI: position-based masking leaves secrets in cleartext in the audit log
Impact
The Airflow CLI records its arguments in the audit log but masks secrets by argument position. Some supported command shapes therefore leave secrets in cleartext, for example a trailing --description on Variable commands, --conn-extra, and the inline --password of airflow keycloak-auth-manager commands. A user who can read audit events but is denied Variable and Connection access can read those values through the event-log API. This is a different code path from CVE-2026-50204 and needs its own cleanup step. Airflow 2.x is also affected and will not be fixed.
Who can reach it
An authenticated Airflow user with read access to audit events / the event-log API. Low privilege is enough.
What to do
Upgrade to apache-airflow 3.4.0 or later and restart the Airflow components. Upgrading does not clean up audit-log entries written before the upgrade: purge the affected entries and rotate the secrets they contain. Airflow 2.x is end of life with no fix and must be migrated to 3.4.0+.
References
Related entries
- Apache Airflow scheduler: task-written XCom values are fully deserialized in the scheduler processCVE-2026-86829 · Apache Airflow scheduler (XCom deserialization during dependency evaluation)Unscored
- NVMe/TCP host: a short read is reported to userspace as a complete readCVE-2026-89480 · Linux kernel nvme-tcp host (short-read completion accounting)Unscored
- NVMe/TCP host: a malicious target can read host kernel memory by sending R2T for a READCVE-2026-89481 · Linux kernel nvme-tcp host (R2T direction check)Unscored
- NVMe/TCP host: C2HData for a WRITE_ZEROES command writes into a stale iteratorCVE-2026-89482 · Linux kernel nvme-tcp host (C2HData receive gate, WRITE_ZEROES path)Unscored
- Linux kernel nvme: discard fallback page is never zeroed, leaking kernel memory to the controllerCVE-2026-89483 · Linux kernel nvme core (DSM discard fallback page)Unscored
- Linux CephFS client: leaked inode reference on aborted writeback panics the node at umountCVE-2026-89646 · Linux kernel CephFS client (ceph_submit_write writeback abort at umount)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.