CVE-2026-48828

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0

Description The Bulk Variables API fails to pass the variable's key to the redactor. This prevents the should hide value for key function from identifying secret-suffixed key names, such as * password, * token, or * secret. Consequently, an authenticated user with bulk Variable read permissions can retrieve plaintext values from JSON-decodable variables that should have been redacted.

Recommendations Upgrade to version 3.3.0 or later.