CVE-2026-113504 · Package
NO FIX YET · SEE WHAT TO DO
Airflow's secrets masker stopped checking nested data after five levels, so a registered secret such as a Connection password or Variable value can appear in cleartext in task logs and rendered template fields. A user who can read those logs or rendered templates, but should not see the secret, could read it.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Airflow where users with access to task logs or rendered template fields should not be able to see certain secrets. Exposure needs a secret registered with the masker that sits more than five containers deep under non-sensitive keys. Installations where all log and template readers are already trusted with those secrets are less exposed.
Not affected if all-log-readers-trusted, secrets-not-nested
Who cares apache-airflow, python, self-hosted
airflow version or pip show apache-airflow.3.4.0 or later, per the advisory.Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.