Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the redact method of the secrets masker in secretsmasker.py. A user who can read task logs or rendered template fields can read a registered secret such as a...

CVE-2026-113504

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-111452

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-113504 Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-113504 Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

EUVD-2026-119894

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-113504

In Apache Airflow , a vulnerability exists in the secrets masker component which fails to descend into nested structures beyond five levels. Consequently, secrets such as Connection passwords or Variable values nested deeper than five containers under non-sensitive keys are exposed in cleartext w...

CVE-2026-113504

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-111452 Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-111452

Apache Airflow contains a vulnerability where the secrets masker fails to redact sensitive values stored under camelCase keys (e.g., privateKey, connectionString, webhookUrl, accessKey). Because the masker only recognizes snake_case formats, these credentials remain visible in task logs , rendere...

EUVD-2026-119888

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-111452

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as "privateKey", "connectionString", "webhookUrl" or "accessKey" — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered...

CVE-2026-111452 Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-113504: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered…

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

PT-2026-140277

Apache Airflow's secrets masker matched sensitive key names only in their snake case form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-111452: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under…

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

PT-2026-140281

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

Apache Airflow 3.3.2 (mask_secret()) Secrets Masker Deep-Nesting Secret Leak

Summary Apache Airflow is an open-source platform for developing, scheduling, and monitoring workflows, such as traditional time based or event-triggered batch-oriented data pipelines, machine learning, model training, and agentic or LLM-based workloads. Airflow’s extensible Python framework...

Apache Airflow 3.3.2 Secrets Masker Deep-Nesting Secret Leak

Apache Airflow version 3.3.2 contains a secret-masking flaw that can disclose registered secrets in task logs when string values are deeply nested under non-sensitive keys. !/usr/bin/env python Apache Airflow 3.3.2 masksecret Secrets Masker Deep-Nesting Secret Leak Vendor: The Apache Software...

CLEANSTART-2026-UV14417 Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI

Security vulnerability affects the airflow-3 package. Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI...