CVE-2026-111452
Received Received - Intake

Apache Airflow Secrets Masker Exposure in Logs

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: Apache Software Foundation

Description
Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses. A user who can read task logs or rendered templates, but is not meant to see those credentials, could read them in cleartext. Users are advised to upgrade to apache-airflow 3.4.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-111452
EUVD
EUVD-2026-119888

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Airflow From 0 (inc) to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Airflow's secrets masker failed to redact sensitive values stored under camelCase keys like privateKey or connectionString. The masking logic only matched snake_case keys, leaving camelCase keys unredacted in logs, templates, or API responses.

Detection Guidance

Check Apache Airflow task logs, rendered templates, or API responses for sensitive values stored under camelCase keys like privateKey, connectionString, webhookUrl, or accessKey. These values should be redacted but may appear in cleartext due to the vulnerability.

Impact Analysis

An attacker with read access to task logs, rendered templates, or API responses could view sensitive credentials in cleartext if they were stored under camelCase keys. This could lead to unauthorized access to systems or data.

Compliance Impact

This vulnerability could result in unauthorized exposure of sensitive data, potentially violating GDPR's data protection principles or HIPAA's security requirements for protecting health information.

Mitigation Strategies

Upgrade Apache Airflow to version 3.4.0 or later to apply the fix for the secrets masker functionality. This ensures proper redaction of sensitive values regardless of key naming conventions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...