Apache Airflow secrets masker bounded at depth 5
Apache Airflow secrets masker stops descending into nested structures after five levels, exposing deeply-nested registered secrets in task logs.
30
CVE-2026-113504
Secrets Masker Depth Limit in Apache Airflow
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's secrets masker does not descend past five levels in nested structures. A secret registered with the masker and appearing more than five levels deep under non-sensitive keys is shown in cleartext in task logs and rendered templates. Users who can read task logs or rendered templates can view these secrets.
What to do: Upgrade to Apache Airflow 3.4.0 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | — | 3.4.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
- Weakness
- CWE-497