CVE-2026-113504
Received Received - Intake

Apache Airflow Secrets Masker Cleartext Exposure in Nested Structures

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: Apache Software Foundation

Description
Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-113504
EUVD
EUVD-2026-119894

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Airflow From 0 (inc) to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Airflow's secrets masker previously stopped masking secrets after five levels of nesting. This meant secrets stored deeper than five levels in nested structures (like dictionaries or lists) were exposed in cleartext in task logs or rendered templates. Attackers with read access to these logs or templates could view sensitive information like passwords or variable values.

Impact Analysis

If you use Apache Airflow and store secrets in deeply nested structures, unauthorized users with access to task logs or rendered templates could read those secrets. This includes passwords, API keys, or other sensitive data, potentially leading to data breaches or unauthorized system access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) or HIPAA (health information privacy) by exposing sensitive personal or health data in logs or templates. Organizations may face legal penalties, fines, or reputational damage if such breaches occur due to inadequate secret masking.

Mitigation Strategies

Upgrade Apache Airflow to version 3.4.0 or later to address the secrets masking issue. This version includes the fix for the vulnerability where secrets nested deeper than five levels were not masked in logs or templates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...