Sensitive Data Exposure in Apache Airflow by Apache
CVE-2026-111452

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Airflow
Vendor
CVE Published:
9 November 2026

What is CVE-2026-111452?

Apache Airflow contains a vulnerability where its secrets masker fails to match sensitive key names stored in camelCase format. Keys such as privateKey, connectionString, webhookUrl, and accessKey may remain visible in task logs, rendered template fields, or API responses, exposing potentially confidential information to unauthorized users with access to these logs. Users are urged to update to Apache Airflow version 3.4.0 or newer to mitigate this issue.

Affected Version(s)

Apache Airflow 0 < 3.4.0

References

https://github.com/apache/airflow/pull/74840
patch
https://lists.apache.org/thread.html/n0qggmo6o10hxojqr26g...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anass Bali / 0xbaas
Jarek Potiuk
.