CVE-2026-65017
Received Received - Intake

Information Disclosure in Apache Airflow Config API

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Apache Software Foundation

Description
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-65017
EUVD
EUVD-2026-57272

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache airflow to 3.3.1 (exc)
apache airflow From 3.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Airflow's Config API in multi-team deployments failed to mask team-scoped sensitive configuration values. An authenticated Viewer with only configuration-read access could read team-scoped Celery broker URLs, including embedded credentials, in cleartext. The system did not normalize team-prefixed sections before checking sensitivity, allowing exposure of these values via API endpoints like GET /config.

Detection Guidance

Check Apache Airflow API responses for exposed team-scoped sensitive values. Use curl to query GET /config endpoint and inspect if team-scoped Celery broker URLs with credentials appear in cleartext. Example: curl -u <username>:<password> http://<airflow-server>/api/v1/config. Also review airflow config list output for unmasked team-scoped secrets.

Impact Analysis

Attackers with limited access could extract sensitive credentials from team-scoped configurations, potentially leading to unauthorized access to systems, data breaches, or lateral movement within the environment. This could compromise data integrity and confidentiality in multi-team deployments.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protecting health information. Organizations may face compliance penalties and reputational damage due to potential data leaks.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.1 or later to apply the fix that normalizes team-scoped sections before masking sensitive values. If immediate upgrade is not possible, disable multi-team mode or restrict access to the Config API endpoints until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65017. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart