Description

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary. This is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T16:17:04.640Z",
  "pubdate": "2026-08-12T16:17:04.640Z",
  "executiveSummary": "An incomplete-fix follow-up vulnerability exists in Apache Airflow involving the secrets masker mechanism, which fails to properly hide deeply nested sensitive values contained within lists, tuples, or sets when displayed in the Variables UI.\nThe vulnerability type is an incomplete fix leading to information exposure, specifically bypassing the intended shoulder-surfing defense mechanism for sensitive keys.\nThe impact is limited to the UI layer, where authenticated users are exposed to unmasked sensitive Airflow Variables that exceed the default recursion-depth limit for collections.\nThe affected product is Apache Airflow, specifically deployments that applied the previous patch for CVE-2026-42358 but remain vulnerable due to residual unmasked list, tuple, and set structures beyond the depth limit.\nRisk implications are moderate, though technically constrained because any authenticated user capable of viewing the Variable in the UI already possesses the authorization to read its full value through the Variables REST API.\nAttacker capabilities require authenticated access to the Apache Airflow user interface.\nExploitation requirements include the presence of sensitive secrets stored within deeply nested list, tuple, or set data structures inside Airflow Variables, combined with UI access.",
  "technicalDetails": "The root cause of the vulnerability stems from an incomplete remediation in the Apache Airflow secrets masker, which was originally updated under CVE-2026-42358 to make dictionary traversal unbounded regarding recursion depth.\nThe vulnerable component is the secrets masking logic responsible for sanitizing sensitive key names prior to rendering them in the Apache Airflow UI.\nWhen sensitive values are structured inside collections such as lists, tuples, or sets that exceed the configured recursion-depth limit, the masking algorithm fails to descend into these nested structures.\nConsequently, the sanitization routine bypasses the deeply nested elements, resulting in the raw, unmasked secret values being rendered directly within the Variables UI.\nAuthentication requirements dictate that the observer must be an authenticated user capable of accessing the Airflow UI and viewing the specific Variables.\nPrivilege requirements are minimal, requiring only standard authenticated access to the dashboard where the unmasked variable is rendered.\nNetwork exposure is constrained to the web interface hosting the Apache Airflow application.\nThe attack flow proceeds as follows: 1) An administrator or user stores a sensitive value under a recognized sensitive key name within an Airflow Variable, wrapping the value in a list, tuple, or set structure that exceeds the recursion-depth limit. 2) An authenticated user navigates to the Variables UI. 3) The secrets masker evaluates the variable structure but stops descending into the collection once the recursion-depth threshold is reached. 4) The UI renders the underlying sensitive data in plaintext, bypassing the intended shoulder-surfing defense.\nPost-exploitation impact is minimal in terms of privilege escalation or data confidentiality breaches beyond existing access controls, because authenticated users who can view the Variable in the UI can natively read its full value through the Variables REST API."
}