Vulnerability · low
Apache Airflow secrets masker misses camelCase sensitive keys (CVE-2026-111452)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Airflow deployments storing secrets under camelCase key names
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
The Brief
- Apache Airflow's secrets masker matched sensitive key names only in snake_case form.
- Values stored under camelCase keys such as privateKey, connectionString and webhookUrl were not matched against the sensitive-field list.
- The issue affects Apache Airflow before 3.4.0 and is tracked as CVE-2026-111452.
Why it matters
If your Airflow deployment stores secrets under camelCase key names, those values may not be masked as intended, so upgrading to 3.4.0 or later closes this gap.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Airflow is a developer and data-ops orchestration tool that teams build with and run. |
| No | Core infrastructure | Judgment: a single framework, not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: Apache Airflow is a widely used workflow orchestration platform across many teams. |
| No | Exploited in the wild | Open Source Security advisory describes a masking flaw only; it reports no observed attacks or KEV listing. |
| No | Public exploit | Open Source Security advisory describes the flaw but reports no published exploit code or PoC. |
| No | Remote, no login | Open Source Security advisory does not say the flaw is exploitable remotely without credentials. |
| No | Full takeover | Open Source Security advisory describes a secrets masking failure, not code execution or privilege escalation. |
| No | Secrets exposed | Open Source Security advisory describes unmasked values but does not report any actual stolen or exposed secrets. |
| No | Supply chain | Open Source Security advisory describes a normal bug in legitimate code, not malicious code shipped. |
| No | No fix yet | Open Source Security advisory lists affected versions as before 3.4.0, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Source
CVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided