Insertion of Sensitive Information Into Sent Data

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the UI display. An attacker can view sensitive variable values by accessing deeply nested dat...

CVE-2026-54183

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

EUVD-2026-57310

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-54183

Apache Airflow's secrets masker failed to hide sensitive values in the Variables UI when they were nested inside a list, tuple, or set beyond the masker's recursion-depth limit. The prior fix for CVE-2026-42358 made only the dictionary traversal unbounded, leaving these collection types unmasked....

CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

PT-2026-71138

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow...