PT-2026-56180

CVE-2026-49487

Published

2026-07-07

Updated

2026-10-10

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0

Description The REST API task-instance detail and list endpoints return a deferred task's trigger kwargs without masking. This allows any authenticated user with DAG-scoped task-instance read access to view sensitive information, such as provider API keys, in clear text while the task is deferred.

Recommendations Upgrade to version 3.3.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Andrew Rukin

Jarek Potiuk

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor