Apache Airflow secrets masker bounded at depth 5
Original title: CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
Apache Airflow secrets masker stops descending into nested structures after five levels, exposing deeply-nested registered secrets in task logs.
Apache Airflow's secrets masker stops descending into nested structures after five levels, so a secret registered with the masker that appears more than five containers deep under non-sensitive keys is shown in cleartext in task logs and rendered template fields. A user who can read task logs can see the secret. The issue is present in versions before 3.4.0. The disclosure does not indicate active exploitation.
- Affects Apache Airflow before 3.4.0
- Secrets masker bounded at depth 5
- Severity moderate
Impact: registered secrets shown in cleartext in logs
| Product | Affected |
|---|---|
| Apache Airflow | before 3.4.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113504 | Secrets Masker Depth Limit in Apache Airflow | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3. 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.