Description

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T16:17:19.853Z",
  "pubdate": "2026-08-12T16:17:19.853Z",
  "executiveSummary": "A secret exposure vulnerability exists in Apache Airflow due to improper handling of list-shaped JSON values within the Task SDK. This flaw allows sensitive information stored as top-level list variables to bypass the intended masking mechanisms. Consequently, secret values appear in cleartext within task logs and the Rendered Templates UI, posing a significant risk of credential leakage. Any authenticated user with read permissions for task logs or rendered templates can recover these unmasked secret values without requiring special configuration or elevated privileges. This issue represents the list-shaped counterpart of CVE-2026-59244, whose prior remediation only addressed dictionary-shaped values, leaving deployments that applied that fix still vulnerable. Impacted systems include Apache Airflow deployments utilizing versions prior to the recommended patch level. The risk implication is unauthorized access to sensitive operational credentials and configuration secrets. Remediation requires upgrading the affected Apache Airflow deployment to version 3.3.1 or later to ensure comprehensive secret masking across all supported data structures.",
  "technicalDetails": "The root cause of the vulnerability resides within the Apache Airflow Task SDK secret masking logic, specifically in how it processes the deserialized data types of Airflow Variables. During task execution and template rendering, the framework attempts to sanitize sensitive data by evaluating the structure of the stored variable value to apply redaction. The masking implementation explicitly checked for deserialized values matching string or dictionary data types. However, when a Variable contained a JSON value structured as a list at the top level, neither the string nor the dictionary condition was met. As a result, the list-shaped variable bypasses the sanitization filter entirely and is returned in cleartext to downstream consumers.\nThe vulnerable component is the Apache Airflow Task SDK variable handling and secret redaction subsystem. The attack flow begins when an administrator or privileged user stores a secret as a top-level JSON list within an Airflow Variable. Subsequently, a data pipeline or task references this variable within its execution context or rendered templates. During runtime, the Task SDK fails to mask the list contents. The unmasked secret values are then written to the task execution logs and made visible within the Rendered Templates UI.\nExploitation requires no special privileges beyond standard authentication and read access to task logs or the Rendered Templates UI of a task that explicitly references the vulnerable Variable. Because the secret values are stored in plaintext logs or UI elements, any authenticated user capable of viewing these resources can trivially extract the sensitive information. The post-exploitation impact includes the potential compromise of downstream services, APIs, databases, or infrastructure credentials that rely on the exposed secrets for authentication."
}