PT-2026-71138

CVE-2026-54183

Published

2026-08-12

Updated

2026-10-10

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow Variables with deeply-nested values being displayed unmasked in the Variables UI. This issue serves as a shoulder-surfing defense and does not bypass access-control boundaries, as authenticated users with UI access can already retrieve the full value via the Variables REST API.

Recommendations Upgrade to apache-airflow version 3.3.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jarek Potiuk

Omkhar Arasaratnam

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor