CVE-2026-48828
published 2026-07-07CVE-2026-48828: The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which…
PriorityP341medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.66%
47.5th percentile
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 3.3.0 | 3.3.0 |
| apache_software_foundation | apache_airflow | < 3.3.0 | 3.3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Airflow up to 3.2.x Bulk Variables API missing encryption (EUVD-2026-42028 / WID-SEC-2026-2223)
vuldb·2026-07-08·CVSS 6.5
CVE-2026-48828 [MEDIUM] Apache Airflow up to 3.2.x Bulk Variables API missing encryption (EUVD-2026-42028 / WID-SEC-2026-2223)
A vulnerability identified as problematic has been detected in Apache Airflow up to 3.2.x. Impacted is an unknown function of the component Bulk Variables API. Performing a manipulation results in missing encryption of sensitive data.
This vulnerability was named CVE-2026-48828. The attack may be initiated remotely. There is no available exploit.
GHSA
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*
ghsa_unreviewed·2026-07-07
CVE-2026-48828 [MEDIUM] CWE-200 The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-07
Published