---
id: "CVE-2026-50204"
page: "https://infrastack.ai/live/CVE-2026-50204"
kind: "vulnerability"
aliases: ["CVE-2026-50204"]
title: "Apache Airflow: audit log exposed connection and variable secrets in cleartext"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apache-airflow", "infrastructure", "python", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-11-09T10:17:10+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:26:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50204", "first_seen_at": "2026-11-09T10:25:49+00:00"}]
exploit_sources: []
---

# Apache Airflow: audit log exposed connection and variable secrets in cleartext

Link for people: https://infrastack.ai/live/CVE-2026-50204 (this .md is for agents)

Apache Airflow wrote Connection and Variable secret values in cleartext into the audit log's Log.extra column because the secrets masker only matched configured key names. A low-privilege authenticated user with read access to the event-log API could read those rows and recover the stored credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `airflow version` or `pip show apache-airflow`; versions below `3.4.0` are affected.
- Review who holds read access to the event-log / audit API in the Airflow web UI and REST API.
- Inspect the `log` table's `extra` column for stored connection or variable values, if the deployment is in scope.

## Fix

- apache-airflow: upgrade to `3.4.0` or later, which masks these values and restricts the affected audit rows to authorized users.

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50204

## From the sources

Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_