Apache Airflow before 3.4.0 exposes secrets in audit logs and APIs
2026-11-09: Report details secrets masker stopping at depth 5 exposing deeply-nested secrets in task logs.
Apache Airflow before 3.4.0 exposes Connection and Variable secrets in cleartext in audit logs and Connections API due to incomplete masking.
Apache Airflow versions before 3.4.0 store Connection and Variable secrets in cleartext in audit logs because the secrets masker matches only snake_case key names. It fails to redact camelCase keys such as privateKey, connectionString, webhookUrl and accessKey, and stops descending into nested structures after depth 5. CLI argument masking by position leaves some secrets exposed including --conn-extra and Variable descriptions. The apprise provider config extra is returned unmasked in the Connections API. Low-privilege users with read access to the audit or Connections API can retrieve these secrets.
- Affects Apache Airflow before 3.4.0
- CVE-2026-50204: masker matches only snake_case keys
- CVE-2026-111452: misses camelCase keys including privateKey
- CVE-2026-113504: masker bounded at depth 5
- CVE-2026-86468: CLI misses Variable descriptions and --conn-extra
- CVE-2026-107474: apprise config extra returned unmasked
Timeline
dated events in the reporting · oldest first- Nov 9, 2026CVE-2026-50204 reported on audit-log secrets masker · oss-security
- Nov 9, 2026CVE-2026-86468 reported on CLI argv masking · oss-security
- Nov 9, 2026CVE-2026-107474 reported on apprise connection config · oss-security
- Nov 9, 2026CVE-2026-111452 reported on secrets masker camelCase keys · oss-security
- Nov 9, 2026CVE-2026-113504 reported on nested secrets masker · oss-security
What each outlet adds
beyond the shared facts- oss-securityFive separate CVEs detailed on Airflow secrets masking flaws
- Vendors
- Apache
- Products
- AirflowApache Airflow
Coverage
oldest first · one row per article · UTC- · 2d ago
oss-securityFirst report
Apache Airflow audit-log secrets masker redacts by key name only
Apache Airflow audit log stored Connection and Variable secret values in cleartext because the secrets masker matched only on configured sensitive key names.
- · 2d ago
Apache Airflow CLI masking misses Variable values and --conn-extra (CVE-2026-86468)
CLI argument masking by position leaves secrets like --conn-extra and Variable descriptions in cleartext audit logs.
- · 2d ago
Apache Airflow Connections API exposes apprise config extra in cleartext (CVE-2026-107474)
The apprise provider's config extra is returned unmasked in the Connections API allowing credential exposure in versions before 3.4.0.
- · 2d ago
Airflow secrets masker misses camelCase sensitive keys
Values under privateKey, connectionString, webhookUrl, or accessKey can appear unredacted in logs and API output.
- · 2d ago
Apache Airflow secrets masker bounded at depth 5
Apache Airflow secrets masker stops descending into nested structures after five levels, exposing deeply-nested registered secrets in task logs.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-107474+4 related CVEs | Cleartext apprise config in Apache Airflow connections API | — | — |