Apache Airflow CLI masking misses Variable values and --conn-extra (CVE-2026-86468)
Original title: CVE-2026-86468: Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs
CLI argument masking by position leaves secrets like --conn-extra and Variable descriptions in cleartext audit logs.
Apache Airflow's CLI records arguments in audit logs but masks secrets by argument position only. This leaves some secrets exposed, such as trailing --description on Variable commands, --conn-extra, and inline --password for keycloak-auth-manager. Users who can read audit events but are denied write access can see the secrets.
- CLI records its arguments in the audit log
- masks secrets by argument position
- some supported command shapes leave secrets in cleartext
- trailing --description on Variable commands
- --conn-extra, and the inline --password of airflow keycloak-auth-manager commands
Impact: exposure of secrets in audit logs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86468 | Cleartext secrets in Apache Airflow audit logs via CLI arguments | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.