Sensitive Data Exposure in Apache Airflow CLI

CVE-2026-86468

What is CVE-2026-86468?

Apache Airflow's Command Line Interface (CLI) logs command arguments in its audit log while attempting to mask sensitive information based on argument position. However, certain command shapes, including trailing --description on variable commands and inline --password options in various commands, can allow sensitive secrets to be recorded in cleartext. This exposure enables unauthorized users who can access audit events to potentially retrieve sensitive values via the event-log API, even if they lack direct access to the variables and connections.

References