Apache Airflow CLI masking misses Variable values and --conn-extra (CVE-2026-86468)
CLI argument masking by position leaves secrets like --conn-extra and Variable descriptions in cleartext audit logs.
40
CVE-2026-86468
Cleartext secrets in Apache Airflow audit logs via CLI arguments
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's CLI records arguments in the audit log but does not mask secrets for certain command shapes, leaving values like Variable descriptions or Connection extras in cleartext. Users who can read audit events but are denied Variable and Connection access can retrieve secrets through the event-log API. Apache Airflow users before version 3.4.0 are affected.
What to do: Upgrade to Apache Airflow 3.4.0 or later. Purge pre-upgrade audit entries and rotate exposed secrets.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | — | 3.4.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API. Users of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
- Weakness
- CWE-532