{"id":"CVE-2026-111452","kind":"vulnerability","aliases":["CVE-2026-111452"],"related":[],"title":"Apache Airflow: camelCase secret keys leak into logs and API responses","description":"Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses. A user who can read task logs or rendered templates, but is not meant to see those credentials, could read them in cleartext. Users are advised to upgrade to apache-airflow 3.4.0 or later.","summary":"Airflow's secrets masker only redacted sensitive key names written in snake_case, so values under keys like privateKey or connectionString were shown in cleartext. A user who can read task logs, rendered templates or the API, but should not see those credentials, can read them.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","package","python","self-hosted"],"not_affected_if":["no-untrusted-readers","snake-case-keys-only"],"how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`\n- Review Connection extras and Variables for camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey`","fix":"- apache-airflow `3.4.0` or later","status":"open","published_at":"2026-11-09T10:17:03+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:50+00:00","updated_at":"2026-11-09T10:26:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:50Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow `3.4.0` or later","reach":"network","title":"Apache Airflow: camelCase secret keys leak into logs and API responses","impact":"medium","summary":"Airflow's secrets masker only redacted sensitive key names written in snake_case, so values under keys like privateKey or connectionString were shown in cleartext. A user who can read task logs, rendered templates or the API, but should not see those credentials, can read them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-airflow","self-hosted","python"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Stored credentials readable in cleartext by users not meant to see them","analyst_note":"","how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`\n- Review Connection extras and Variables for camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["snake-case-keys-only","no-untrusted-readers"],"who_is_affected":"Teams running Apache Airflow that store credentials under camelCase keys in Connection extras or Variables, and that let users read task logs, rendered templates or API responses. Deployments that keep secrets only in snake_case keys or restrict those views to the people who should see the credentials are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4617,"output_tokens":530,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111452':14A,17A '-2026':13A,16A '3.4.0':153C 'accesskey':98C 'advis':146C 'airflow':2A,20B,26B,72C,152C 'apach':1A,19B,71C,151C 'apache-airflow':18B,150C 'api':10A,62B,119C 'camelcas':3A,90C 'case':38B,84C 'cleartext':50B,143C 'connect':103C 'connectionstr':46B,95C 'could':139C 'credenti':68B,138C 'cve':12A,15A 'exampl':100C 'extra':105C 'field':117C 'form':85C 'host':25B 'key':5A,33B,42B,78C,91C 'later':155C 'leak':6A 'like':43B 'log':8A,57B,114C,127C 'masker':29B,75C 'match':76C 'meant':134C 'name':34B,79C 'packag':21B 'privatekey':44B,94C 'python':22B 'read':55B,70B,125C,140C 'redact':31B,111C 'render':58B,115C,129C 'respons':11A,120C 'secret':4A,28B,74C 'see':66B,136C 'self':24B 'self-host':23B 'sensit':32B,77C 'shown':48B 'snake':37B,83C 'store':88C 'task':56B,113C,126C 'templat':59B,116C,130C 'upgrad':148C 'user':52B,122C,144C 'valu':40B,87C 'variabl':108C 'webhookurl':96C 'written':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow that store credentials under camelCase keys in Connection extras or Variables, and that let users read task logs, rendered templates or API responses. Deployments that keep secrets only in snake_case keys or restrict those views to the people who should see the credentials are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","medium","package","python","selfhosted"],"campaign_type":null,"search_a":"'-111452':14A,17A '-2026':13A,16A 'airflow':2A 'apach':1A 'api':10A 'camelcas':3A 'cve':12A,15A 'key':5A 'leak':6A 'log':8A 'respons':11A 'secret':4A","search_b":"'airflow':20B,26B 'apach':19B 'apache-airflow':18B 'api':62B 'case':38B 'cleartext':50B 'connectionstr':46B 'credenti':68B 'host':25B 'key':33B,42B 'like':43B 'log':57B 'masker':29B 'name':34B 'packag':21B 'privatekey':44B 'python':22B 'read':55B,70B 'redact':31B 'render':58B 'secret':28B 'see':66B 'self':24B 'self-host':23B 'sensit':32B 'shown':48B 'snake':37B 'task':56B 'templat':59B 'user':52B 'valu':40B 'written':35B","search_c":"'3.4.0':153C 'accesskey':98C 'advis':146C 'airflow':72C,152C 'apach':71C,151C 'apache-airflow':150C 'api':119C 'camelcas':90C 'case':84C 'cleartext':143C 'connect':103C 'connectionstr':95C 'could':139C 'credenti':138C 'exampl':100C 'extra':105C 'field':117C 'form':85C 'key':78C,91C 'later':155C 'log':114C,127C 'masker':75C 'match':76C 'meant':134C 'name':79C 'privatekey':94C 'read':125C,140C 'redact':111C 'render':115C,129C 'respons':120C 'secret':74C 'see':136C 'sensit':77C 'snake':83C 'store':88C 'task':113C,126C 'templat':116C,130C 'upgrad':148C 'user':122C,144C 'valu':87C 'variabl':108C 'webhookurl':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111452","severity":null,"published_at":"2026-11-09T10:17:03+00:00","modified_at":"2026-11-09T10:17:03+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}