{"id":"CVE-2026-50204","kind":"vulnerability","aliases":["CVE-2026-50204"],"related":[],"title":"Apache Airflow: audit log exposed connection and variable secrets in cleartext","description":"Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users.","summary":"Apache Airflow wrote Connection and Variable secret values in cleartext into the audit log's Log.extra column because the secrets masker only matched configured key names. A low-privilege authenticated user with read access to the event-log API could read those rows and recover the stored credentials.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","infrastructure","python","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`; versions below `3.4.0` are affected.\n- Review who holds read access to the event-log / audit API in the Airflow web UI and REST API.\n- Inspect the `log` table's `extra` column for stored connection or variable values, if the deployment is in scope.","fix":"- apache-airflow: upgrade to `3.4.0` or later, which masks these values and restricts the affected audit rows to authorized users.","status":"open","published_at":"2026-11-09T10:17:10+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:41+00:00","updated_at":"2026-11-09T10:26:41+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-09T10:26:41Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow: upgrade to `3.4.0` or later, which masks these values and restricts the affected audit rows to authorized users.","reach":"network","title":"Apache Airflow: audit log exposed connection and variable secrets in cleartext","impact":"medium","summary":"Apache Airflow wrote Connection and Variable secret values in cleartext into the audit log's Log.extra column because the secrets masker only matched configured key names. A low-privilege authenticated user with read access to the event-log API could read those rows and recover the stored credentials.","audience":"developers","category":"infrastructure","nicknames":[],"who_cares":["apache-airflow","python","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege users read stored connection and variable credentials verbatim","analyst_note":"","how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`; versions below `3.4.0` are affected.\n- Review who holds read access to the event-log / audit API in the Airflow web UI and REST API.\n- Inspect the `log` table's `extra` column for stored connection or variable values, if the deployment is in scope.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Deployments of Apache Airflow where authenticated users can read the event-log or audit API. Exposure depends on whether non-admin users hold read access to audit logs that recorded connection or variable secrets. Installations on `3.4.0` or later, or where audit log reads are limited to trusted administrators, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":4607,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-50204':14A,17A '3.4.0':146C 'access':60B,112C,123C 'affect':126C,156C 'airflow':2A,20B,27B,77C,145C 'apach':1A,19B,26B,76C,144C 'apache-airflow':18B,143C 'api':66B,119C 'audit':3A,38B,79C,118C,157C 'authent':56B,105C 'author':160C 'cleartext':11A,35B,88C 'column':42B,92C 'configur':49B,100C 'connect':6A,29B,82C,127C 'could':67B,130C 'credenti':75B,137C 'cve':12A,15A 'event':64B,116C 'event-log':63B,115C 'expos':5A 'host':25B 'infrastructur':21B 'key':50B,102C 'later':148C 'log':4A,39B,65B,80C,117C 'log.extra':41B,91C 'low':54B,107C 'low-privileg':53B,106C 'mask':150C 'masker':46B,96C 'match':48B,97C 'name':51B,103C 'prior':122C 'privileg':55B,108C 'python':22B 'read':59B,68B,111C,131C 'recov':72B,135C 'restrict':154C 'row':70B,133C,158C 'secret':9A,32B,45B,85C,95C 'self':24B 'self-host':23B 'sensit':101C 'store':74B,81C 'upgrad':141C 'user':57B,109C,139C,161C 'valu':33B,86C,152C 'variabl':8A,31B,84C,129C 'verbatim':138C 'wrote':28B","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache Airflow where authenticated users can read the event-log or audit API. Exposure depends on whether non-admin users hold read access to audit logs that recorded connection or variable secrets. Installations on `3.4.0` or later, or where audit log reads are limited to trusted administrators, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","infrastructure","python","selfhosted","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-50204':14A,17A 'airflow':2A 'apach':1A 'audit':3A 'cleartext':11A 'connect':6A 'cve':12A,15A 'expos':5A 'log':4A 'secret':9A 'variabl':8A","search_b":"'access':60B 'airflow':20B,27B 'apach':19B,26B 'apache-airflow':18B 'api':66B 'audit':38B 'authent':56B 'cleartext':35B 'column':42B 'configur':49B 'connect':29B 'could':67B 'credenti':75B 'event':64B 'event-log':63B 'host':25B 'infrastructur':21B 'key':50B 'log':39B,65B 'log.extra':41B 'low':54B 'low-privileg':53B 'masker':46B 'match':48B 'name':51B 'privileg':55B 'python':22B 'read':59B,68B 'recov':72B 'row':70B 'secret':32B,45B 'self':24B 'self-host':23B 'store':74B 'user':57B 'valu':33B 'variabl':31B 'wrote':28B","search_c":"'3.4.0':146C 'access':112C,123C 'affect':126C,156C 'airflow':77C,145C 'apach':76C,144C 'apache-airflow':143C 'api':119C 'audit':79C,118C,157C 'authent':105C 'author':160C 'cleartext':88C 'column':92C 'configur':100C 'connect':82C,127C 'could':130C 'credenti':137C 'event':116C 'event-log':115C 'key':102C 'later':148C 'log':80C,117C 'log.extra':91C 'low':107C 'low-privileg':106C 'mask':150C 'masker':96C 'match':97C 'name':103C 'prior':122C 'privileg':108C 'read':111C,131C 'recov':135C 'restrict':154C 'row':133C,158C 'secret':85C,95C 'sensit':101C 'store':81C 'upgrad':141C 'user':109C,139C,161C 'valu':86C,152C 'variabl':84C,129C 'verbatim':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50204","severity":null,"published_at":"2026-11-09T10:17:10+00:00","modified_at":"2026-11-09T10:17:10+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}