Airflow secrets masker misses camelCase sensitive keys
Original title: CVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list
Values under privateKey, connectionString, webhookUrl, or accessKey can appear unredacted in logs and API output.
Apache Airflow before 3.4.0 matches sensitive key names in the secrets masker only in snake_case. Values stored under camelCase keys such as privateKey, connectionString, webhookUrl, or accessKey, including in a Connection extra or a Variable, were not redacted in task logs, rendered template fields, or API responses. A user who can read task output could see those values. Severity is low.
Unconfirmed: The snippet ends before stating the full reader audience and does not explicitly name the fixed release.
- CVE-2026-111452 affects Apache Airflow before 3.4.0.
- Unmatched examples include privateKey, connectionString, webhookUrl, and accessKey.
- Exposure paths named are task logs, rendered templates, and API responses.
- The advisory text cuts off while describing who can read the output.
Impact: Unredacted secrets in logs, templates, and API responses
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | before 3.4.0 | 3.4.0 |
- 1.Upgrade Apache Airflow to 3.4.0.
- CVEs
- CVE-2026-111452
- Vendors
- Apache
- Products
- Apache Airflow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111452 | CamelCase keys not masked in Apache Airflow | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3. 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.