Airflow secrets masker misses camelCase sensitive keys
Values under privateKey, connectionString, webhookUrl, or accessKey can appear unredacted in logs and API output.
36
CVE-2026-111452
CamelCase keys not masked in Apache Airflow
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's secrets masker only matches snake_case key names, missing camelCase ones like privateKey, connectionString, webhookUrl or accessKey in Connection extra or Variables. Users who can read task logs or rendered templates can see these credentials in cleartext. Affected are Apache Airflow users until upgraded.
What to do: Upgrade to Apache Airflow 3.4.0 or later. No workaround given.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | — | 3.4.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses. A user who can read task logs or rendered templates, but is not meant to see those credentials, could read them in cleartext. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
- Weakness
- CWE-522