CVE-2026-49487

Apache Airflow versions before 3.3.0 are vulnerable to information disclosure via the REST API task-instance detail and list endpoints . The root cause is that these endpoints return a deferred task's trigger kwargs without masking. If a deferred operator includes a secret, such as a provider API...