Sensitive Data Exposure in Apache Airflow by Apache

CVE-2026-113504

What is CVE-2026-113504?

Apache Airflow's secrets masker has a limitation in its ability to process nested structures, halting after five levels of depth. This flaw permits sensitive secrets, such as Connection passwords and Variable values, to be exposed in cleartext within task logs and rendered template fields. Users with access to these logs and templates, who are not authorized to view these secrets, could potentially read them, leading to unauthorized access to sensitive information. It is strongly recommended that users upgrade to Apache Airflow version 3.4.0 or newer to mitigate this issue.

References