CVE-2026-54183

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow Variables with deeply-nested values being displayed unmasked in the Variables UI. This issue serves as a shoulder-surfing defense and does not bypass access-control boundaries, as authenticated users with UI access can already retrieve the full value via the Variables REST API.

Recommendations Upgrade to apache-airflow version 3.3.1 or later.