CVE-2026-48828
published 2026-07-07CVE-2026-48828: The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.66%
51.1th percentile
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 3.3.0 | 3.3.0 |
| apache | airflow | >= 3.3.0 < 3.3.1 | 3.3.1 |
| apache_software_foundation | apache_airflow | >= 3.3.0 < 3.3.1 | 3.3.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ghsa6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.
ghsa_unreviewed·2026-08-12·CVSS 6.5
CVE-2026-65017 [MEDIUM] CWE-200 Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised t
GHSA
Apache Airflow Config API exposes team-scoped sensitive configuration values
ghsa·2026-08-12·CVSS 6.5
CVE-2026-65017 [MEDIUM] CWE-200 Apache Airflow Config API exposes team-scoped sensitive configuration values
Apache Airflow Config API exposes team-scoped sensitive configuration values
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address
VulDB
Apache Airflow up to 3.2.x Bulk Variables API missing encryption (EUVD-2026-42028 / WID-SEC-2026-2223)
vuldb·2026-07-08·CVSS 6.5
CVE-2026-48828 [MEDIUM] Apache Airflow up to 3.2.x Bulk Variables API missing encryption (EUVD-2026-42028 / WID-SEC-2026-2223)
A vulnerability identified as problematic has been detected in Apache Airflow up to 3.2.x. Impacted is an unknown function of the component Bulk Variables API. Performing a manipulation results in missing encryption of sensitive data.
This vulnerability was named CVE-2026-48828. The attack may be initiated remotely. There is no available exploit.
GHSA
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
ghsa·2026-07-07
CVE-2026-48828 [MEDIUM] CWE-200 Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).
GHSA
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*
ghsa_unreviewed·2026-07-07
CVE-2026-48828 [MEDIUM] CWE-200 The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-07
Published