CVE-2026-111452 · Package
NO FIX YET · SEE WHAT TO DO
Airflow's secrets masker only redacted sensitive key names written in snake_case, so values under keys like privateKey or connectionString were shown in cleartext. A user who can read task logs, rendered templates or the API, but should not see those credentials, can read them.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Airflow that store credentials under camelCase keys in Connection extras or Variables, and that let users read task logs, rendered templates or API responses. Deployments that keep secrets only in snake_case keys or restrict those views to the people who should see the credentials are less exposed.
Not affected if no-untrusted-readers, snake-case-keys-only
Who cares apache-airflow, python, self-hosted
airflow version or pip show apache-airflowprivateKey, connectionString, webhookUrl or accessKey3.4.0 or laterApache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses. A user who can read task logs or rendered templates, but is not meant to see those credentials, could read them in cleartext. Users are advised to upgrade to apache-airflow 3.4.0 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.