[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9c27f753-d578-cc10-378e-22b8d850d355@apache.org>
Date: Mon, 09 Nov 2026 06:06:32 +0000
From: Rahul Vats <rahulvats@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based
masking bounded at depth 5 returns deeply-nested registered secrets in
cleartext
Severity: moderate
Affected versions:
- Apache Airflow before 3.4.0
Description:
Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later.
Credit:
Gjoko Krstic, Zero Science Lab (finder)
Jarek Potiuk (remediation developer)
References:
https://github.com/apache/airflow/pull/73793
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-113504
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
