CVE-2026-50204 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Apache Airflow wrote Connection and Variable secret values in cleartext into the audit log's Log.extra column because the secrets masker only matched configured key names. A low-privilege authenticated user with read access to the event-log API could read those rows and recover the stored credentials.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments of Apache Airflow where authenticated users can read the event-log or audit API. Exposure depends on whether non-admin users hold read access to audit logs that recorded connection or variable secrets. Installations on 3.4.0 or later, or where audit log reads are limited to trusted administrators, are less exposed.
Not affected if auth-required, default-config
Who cares apache-airflow, python, self-hosted
airflow version or pip show apache-airflow; versions below 3.4.0 are affected.log table's extra column for stored connection or variable values, if the deployment is in scope.Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.4.0