Nested Key Masking Vulnerability in Apache Airflow

CVE-2026-42360

What is CVE-2026-42360?

A vulnerability in Apache Airflow allows sensitive information such as passwords, tokens, and API keys to be exposed when the rendered-template field exceeds a specified length. This issue arises from improper handling of nested sensitive keys within JSON structures. Specifically, the software stringifies the template before masking sensitive information, leading to a loss of context for nested keys and the potential exposure of plaintext secrets. Authenticated users with access to the UI or API can exploit this flaw to retrieve sensitive data. Users are advised to upgrade to Apache Airflow version 3.2.2 or later to mitigate this risk.

References