CVE-2026-48892
published 2026-07-07CVE-2026-48892: The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and…
PriorityP342medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.66%
51.1th percentile
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 3.3.0 | 3.3.0 |
| apache | airflow | >= 3.3.0 < 3.3.1 | 3.3.1 |
| apache_software_foundation | apache_airflow | < 3.3.0 | 3.3.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ghsa6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.
ghsa_unreviewed·2026-08-12·CVSS 6.5
CVE-2026-65017 [MEDIUM] CWE-200 Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised t
GHSA
Apache Airflow Config API exposes team-scoped sensitive configuration values
ghsa·2026-08-12·CVSS 6.5
CVE-2026-65017 [MEDIUM] CWE-200 Apache Airflow Config API exposes team-scoped sensitive configuration values
Apache Airflow Config API exposes team-scoped sensitive configuration values
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address
VulDB
Apache Airflow up to 3.2.x Config API missing encryption (WID-SEC-2026-2223)
vuldb·2026-07-08·CVSS 6.5
CVE-2026-48892 [MEDIUM] Apache Airflow up to 3.2.x Config API missing encryption (WID-SEC-2026-2223)
A vulnerability labeled as problematic has been found in Apache Airflow up to 3.2.x. The affected element is an unknown function of the component Config API. Executing a manipulation can lead to missing encryption of sensitive data.
The identification of this vulnerability is CVE-2026-48892. The attack may be launched remotely. There is no exploit available.
GHSA
Apache Airflow exposes secrets backend credentials through the Config API
ghsa·2026-07-07
CVE-2026-48892 [MEDIUM] CWE-200 Apache Airflow exposes secrets backend credentials through the Config API
Apache Airflow exposes secrets backend credentials through the Config API
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.
GHSA
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRE
ghsa_unreviewed·2026-07-07
CVE-2026-48892 [MEDIUM] CWE-200 The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRE
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-07
Published