CVE-2026-50204

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description Sensitive data, including Variable values and Connection extra contents, are written to the audit log in cleartext when submitted via bulk endpoints. This occurs because the audit-log masking mechanism only recognizes top-level request fields, while bulk requests nest entities two levels deeper, bypassing the masking process. Consequently, any authenticated user with audit-log read access can recover these secrets, even if they lack permissions to read Variables or Connections. This issue also affects the Airflow UI's Import Variables action, which utilizes these endpoints. The affected API endpoints are PATCH /api/v2/variables and PATCH /api/v2/connections.

Recommendations Upgrade to apache-airflow version 3.3.1 or later.