Information Disclosure in Apache Airflow Bulk Variables API

Executive Summary

The vulnerability in Apache Airflow's Bulk Variables API occurs because the redaction process does not receive the variable's key when handling JSON-encoded variable values. This omission prevents the key-based check that identifies sensitive keys (such as those ending with _password, _token, or _secret) from triggering. As a result, sensitive data stored as JSON in Airflow Variables can be exposed in plaintext to authenticated users with bulk Variable read permission.

Specifically, while plain string values with sensitive keys are properly masked, JSON values containing sensitive information are not redacted due to a missing argument in the redaction function. This flaw allows sensitive JSON data to be retrieved unmasked via the Airflow REST API.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information stored in Apache Airflow Variables. If you store secrets such as passwords, tokens, or other confidential data in JSON-typed Variables with keys that should trigger redaction, an authenticated user with bulk Variable read permission could retrieve these secrets in plaintext.

Such exposure increases the risk of credential compromise, unauthorized access to systems, and potential data breaches, especially in environments where Airflow is used to manage workflows involving sensitive credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if sensitive JSON-typed Airflow Variables with secret-suffixed keys (such as *_password, *_token, *_secret) are being returned in plaintext via the Airflow REST API endpoint /api/v2/variables.

One way to detect this is to perform an authenticated API call to the /api/v2/variables endpoint and inspect whether JSON variable values that should be redacted are instead returned in cleartext.

For example, you can use a command like the following (replace placeholders accordingly):

• curl -X GET "http://<airflow-host>/api/v2/variables" -H "Authorization: Bearer <your_token>"

Then, review the output for any JSON variables with keys ending in _password, _token, or _secret that expose sensitive data in plaintext.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Apache Airflow to version 3.3.0 or later, where the redaction logic for JSON-typed Variables has been fixed.

Until the upgrade can be performed, avoid storing sensitive data in JSON-typed Variables with secret-suffixed keys, or restrict access to users with bulk Variable read permissions.

Additionally, review and audit Variable permissions to limit exposure of sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in Apache Airflow allows authenticated users with bulk Variable read permission to retrieve plaintext sensitive data stored in JSON-typed Variables whose keys would normally trigger redaction. Such exposure of sensitive information could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require proper safeguarding and masking of sensitive data.

Specifically, the failure to redact sensitive JSON values such as passwords, tokens, or secrets means that confidential information could be exposed through the API, increasing the risk of unauthorized data disclosure. This undermines the confidentiality and data protection controls mandated by these standards.

Therefore, affected deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names should upgrade to Apache Airflow 3.3.0 or later to restore proper redaction and maintain compliance.

Useful 0 Not Useful 0