PYSEC-2026-2088

In Apache Airflow before 3.3.0, the REST API task-instance detail and listendpoints returned a deferred task's trigger kwargs without masking. When adeferred operator passed a secret for example a provider API key into itstrigger, any authenticated user with DAG-scoped task-instance read access...