Vulnerability · medium
Airflow audit log masker leaks connection and Variable secrets (CVE-2026-50204)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Airflow deployments with connections or Variables, before 3.4.0
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later
The Brief
- Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column.
- The secrets masker redacted only by key name, so secrets under other keys were persisted unredacted.
- The issue is tracked as CVE-2026-50204 and rated moderate severity; affected versions are Apache Airflow before 3.4.0.
Why it matters
Anyone with access to Airflow's audit log data could read connection and Variable secrets stored in cleartext, so affected deployments should be upgraded.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Airflow is a workflow orchestration platform that data and ops teams build with and run. |
| No | Core infrastructure | A single widely used orchestration framework, not software nearly every team runs. |
| Yes | Popular tool | Apache Airflow is a widely used mainstream data pipeline tool. |
| No | Exploited in the wild | oss-sec post (Rahul Vats) describes the flaw only; no observed attacks reported. |
| No | Public exploit | oss-sec post gives an advisory description; no exploit code or PoC mentioned. |
| No | Remote, no login | oss-sec post does not say the flaw is reachable without credentials. |
| No | Full takeover | oss-sec post describes cleartext secret persistence in logs, not code execution or admin takeover. |
| No | Secrets exposed | oss-sec post says secrets were stored in cleartext; no theft or breach reported. |
| No | Supply chain | oss-sec post describes a masking bug in legitimate code, not malicious code shipped. |
| No | No fix yet | oss-sec post lists affected versions as before 3.4.0, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on the oss-security list
Open Source Security
CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext
Source
CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided