Sensitive Data Exposure in Apache Airflow by Apache

CVE-2026-50204

What is CVE-2026-50204?

Apache Airflow's audit log improperly stored Connection and Variable secret values in cleartext within the Log.extra column. This exposure occurs because the secrets masking mechanism only matched configured sensitive key names. An authenticated low-privilege user, with read access to the event-log or audit API, could potentially access these logs without having prior access to sensitive connections or variables, thereby retrieving the secrets directly. It is crucial for users to upgrade to Apache Airflow version 3.4.0 or later to ensure sensitive values are masked and audit row access is appropriately restricted to authorized users.

References