SecurityFan score 21 · Tier C
CVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list
The Brief
- Apache Airflow's secrets masker matched sensitive key names only in snake_case form.
- Values stored under camelCase keys such as privateKey, connectionString and webhookUrl were not matched against the sensitive-field list.
- The issue affects Apache Airflow before 3.4.0 and is tracked as CVE-2026-111452.
Why it matters
If your Airflow deployment stores secrets under camelCase key names, those values may not be masked as intended, so upgrading to 3.4.0 or later closes this gap.
Who’s affected
- Apache Airflow users running versions before 3.4.0
- Teams storing secrets under camelCase keys such as privateKey or webhookUrl
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
- Apache Airflow 3.4.0
- CVE-2026-111452
- #apache-airflow
- #security
- #secrets-masking
- #cve
- #vulnerability
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`…