Apache Airflow UI Exposure Vulnerability in Secrets Masker

CVE-2026-54183

What is CVE-2026-54183?

The Apache Airflow secrets masker has a limitation that reveals sensitive data when deeply nested values are displayed in the UI. Specifically, while the masker's recursion-depth limit effectively hides values stored under sensitive key names, it fails to mask values nested within lists, tuples, or sets when they exceed that depth limit. This results in potential exposure of sensitive information to authenticated users accessing the Variables UI, even though these users can access the full value through the Variables REST API. This issue represents an incomplete fix of a prior vulnerability (CVE-2026-42358), and organizations using Apache Airflow should upgrade to version 3.3.1 or later to mitigate this risk.

References