CVE-2026-54183
Received Received - Intake

Secrets Masker Flaw in Apache Airflow UI Disclosure

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Apache Software Foundation

Description
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary. This is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-54183
EUVD
EUVD-2026-57310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache airflow From 3.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Airflow's secrets masker hides sensitive values in the UI by redacting keys like passwords. However, it had a recursion-depth limit that failed to mask values nested inside lists, tuples, or sets beyond that limit. This meant sensitive data in deeply nested structures could be visible in the UI even though it should be hidden.

Detection Guidance

Check Apache Airflow UI for unmasked sensitive variables in the Variables view. Inspect logs for exposed secrets during UI rendering. Verify if sensitive keys nested in lists, tuples, or sets appear unredacted beyond recursion limits.

Impact Analysis

An authenticated user with access to the Airflow UI could see sensitive variable values that should have been masked. This exposure is limited to the UI; the same data could already be retrieved via the Variables REST API, so it does not provide new access but weakens the UI's shoulder-surfing defense.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.1 or later to apply the complete fix for secrets masking in nested structures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart