Vulnerability · medium
Apache Airflow secrets masker leaks deeply nested secrets (CVE-2026-113504)
Tier A · Patch today – Before you go home
Who’s exposed: Apache Airflow users running versions before 3.4.0 with registered secrets
Tier A because: Core infrastructure or popular tool AND secrets exposed
Reach
Attack
Damage
Fix
Popular tool · Secrets exposed
What to do
- Upgrade Apache Airflow to 3.4.0 or later
The Brief
- Apache Airflow's secrets masker stops descending into nested structures after five levels.
- Secrets registered with the masker that sit deeper than that are returned in cleartext.
- The oss-security post lists the severity as moderate and affects Apache Airflow versions before 3.4.0.
Why it matters
Secrets such as connection credentials nested deeper than five levels may be shown unmasked where masking is expected, exposing them to anyone who can read that output.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Airflow is a workflow orchestrator that developers and data engineering ops teams build with and run. |
| No | Core infrastructure | Judgment: Airflow is a single widely used framework, not software nearly every team runs like OpenSSH or the kernel. |
| Yes | Popular tool | Judgment: Apache Airflow is a widely used mainstream orchestration platform across many teams. |
| No | Exploited in the wild | oss-sec advisory describes the flaw only; no observed attacks reported. |
| No | Public exploit | oss-sec advisory gives a description; no exploit code or PoC is mentioned. |
| No | Remote, no login | oss-sec advisory does not say the flaw is reachable remotely without credentials. |
| No | Full takeover | oss-sec advisory describes cleartext secret disclosure, which is information disclosure, not code execution or takeover. |
| Yes | Secrets exposed | oss-sec title: masker leaks deeply nested secrets in cleartext, exposing registered secrets such as Connections. |
| No | Supply chain | oss-sec advisory describes a masking bug in legitimate code; no malicious code shipped. |
| No | No fix yet | oss-sec lists affected versions as before 3.4.0, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability posted to the oss-security mailing list by Rahul Vats
Open Source Security
CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
Source
CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided