{"id":"CVE-2026-113504","kind":"vulnerability","aliases":["CVE-2026-113504"],"related":[],"title":"Apache Airflow: secrets masker misses secrets nested over five levels deep","description":"Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later.","summary":"Airflow's secrets masker stopped checking nested data after five levels, so a registered secret such as a Connection password or Variable value can appear in cleartext in task logs and rendered template fields. A user who can read those logs or rendered templates, but should not see the secret, could read it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","package","python","self-hosted"],"not_affected_if":["all-log-readers-trusted","secrets-not-nested"],"how_to_check":"- Check the installed Airflow version with `airflow version` or `pip show apache-airflow`.\n- Look for secrets nested more than five levels deep under non-sensitive keys in task data passed to operators.","fix":"- apache-airflow `3.4.0` or later, per the advisory.","status":"open","published_at":"2026-11-09T10:17:05+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:45+00:00","updated_at":"2026-11-09T10:26:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:45Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow `3.4.0` or later, per the advisory.","reach":"network","title":"Apache Airflow: secrets masker misses secrets nested over five levels deep","impact":"medium","summary":"Airflow's secrets masker stopped checking nested data after five levels, so a registered secret such as a Connection password or Variable value can appear in cleartext in task logs and rendered template fields. A user who can read those logs or rendered templates, but should not see the secret, could read it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-airflow","python","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authorized-looking users read secret values from logs and templates","analyst_note":"Confirm the affected version range and the exact fixed version in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113504; sources here give only the 3.4.0 advisory.","how_to_check":"- Check the installed Airflow version with `airflow version` or `pip show apache-airflow`.\n- Look for secrets nested more than five levels deep under non-sensitive keys in task data passed to operators.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["secrets-not-nested","all-log-readers-trusted"],"who_is_affected":"Teams running Apache Airflow where users with access to task logs or rendered template fields should not be able to see certain secrets. Exposure needs a secret registered with the masker that sits more than five containers deep under non-sensitive keys. Installations where all log and template readers are already trusted with those secrets are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4594,"output_tokens":606,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113504':14A,17A '-2026':13A,16A '3.4.0':160C 'advis':153C 'airflow':2A,20B,26B,79C,159C 'apach':1A,19B,78C,158C 'apache-airflow':18B,157C 'appear':50B,108C 'check':31B 'cleartext':52B,122C 'connect':44B,101C 'contain':112C 'could':76B,148C 'cve':12A,15A 'data':33B 'deep':11A,113C 'descend':84C 'exampl':99C 'field':59B,129C 'five':9A,35B,89C,111C 'host':25B 'key':118C 'later':162C 'level':10A,36B,90C 'log':55B,66B,125C,136C 'masker':4A,29B,82C,97C 'meant':143C 'miss':5A 'nest':7A,32B,86C 'non':116C 'non-sensit':115C 'packag':21B 'password':45B,102C 'python':22B 'read':64B,77B,134C,149C 'regist':39B,94C 'render':57B,68B,127C,138C 'secret':3A,6A,28B,40B,75B,81C,93C,147C 'see':73B,145C 'self':24B 'self-host':23B 'sensit':117C 'shown':120C 'stop':30B,83C 'structur':87C 'task':54B,124C,135C 'templat':58B,69B,128C,139C 'upgrad':155C 'user':61B,131C,151C 'valu':48B,106C 'variabl':47B,105C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow where users with access to task logs or rendered template fields should not be able to see certain secrets. Exposure needs a secret registered with the masker that sits more than five containers deep under non-sensitive keys. Installations where all log and template readers are already trusted with those secrets are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","medium","package","python","selfhosted"],"campaign_type":null,"search_a":"'-113504':14A,17A '-2026':13A,16A 'airflow':2A 'apach':1A 'cve':12A,15A 'deep':11A 'five':9A 'level':10A 'masker':4A 'miss':5A 'nest':7A 'secret':3A,6A","search_b":"'airflow':20B,26B 'apach':19B 'apache-airflow':18B 'appear':50B 'check':31B 'cleartext':52B 'connect':44B 'could':76B 'data':33B 'field':59B 'five':35B 'host':25B 'level':36B 'log':55B,66B 'masker':29B 'nest':32B 'packag':21B 'password':45B 'python':22B 'read':64B,77B 'regist':39B 'render':57B,68B 'secret':28B,40B,75B 'see':73B 'self':24B 'self-host':23B 'stop':30B 'task':54B 'templat':58B,69B 'user':61B 'valu':48B 'variabl':47B","search_c":"'3.4.0':160C 'advis':153C 'airflow':79C,159C 'apach':78C,158C 'apache-airflow':157C 'appear':108C 'cleartext':122C 'connect':101C 'contain':112C 'could':148C 'deep':113C 'descend':84C 'exampl':99C 'field':129C 'five':89C,111C 'key':118C 'later':162C 'level':90C 'log':125C,136C 'masker':82C,97C 'meant':143C 'nest':86C 'non':116C 'non-sensit':115C 'password':102C 'read':134C,149C 'regist':94C 'render':127C,138C 'secret':81C,93C,147C 'see':145C 'sensit':117C 'shown':120C 'stop':83C 'structur':87C 'task':124C,135C 'templat':128C,139C 'upgrad':155C 'user':131C,151C 'valu':106C 'variabl':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113504","severity":null,"published_at":"2026-11-09T10:17:05+00:00","modified_at":"2026-11-09T10:17:05+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}