Apache Airflow audit-log secrets masker redacts by key name only
Original title: CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext
Apache Airflow audit log stored Connection and Variable secret values in cleartext because the secrets masker matched only on configured sensitive key names.
Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows. Affected versions are Apache Airflow before 3.4.0.
- Severity: moderate
- Persists connection and Variable secrets in cleartext
- Affects authenticated low-privilege users with audit API access
Impact: reading connection and variable secrets in cleartext
- 1.Upgrade to Airflow 3.4.0 or later
- 2.Review audit logs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50204 | Cleartext storage of secrets in Apache Airflow audit log | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.