# CVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/595) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-111452-apache-airflow-secrets-masker-camelcase-key-names-privatekey-con-8c491033c2dfaf5c
Kind: security · Impact: low

## In brief

- Apache Airflow's secrets masker matched sensitive key names only in snake_case form.
- Values stored under camelCase keys such as privateKey, connectionString and webhookUrl were not matched against the sensitive-field list.
- The issue affects Apache Airflow before 3.4.0 and is tracked as CVE-2026-111452.

## Why it matters

If your Airflow deployment stores secrets under camelCase key names, those values may not be masked as intended, so upgrading to 3.4.0 or later closes this gap.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later.

## Versions

- Apache Airflow 3.4.0

## CVEs

- CVE-2026-111452

## Timeline

- 2026-11-08: Vulnerability disclosed on oss-sec

## Coverage

- [CVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list](https://seclists.org/oss-sec/2026/q4/595) — Open Source Security, 2026-11-09

Tags: apache-airflow, security, secrets-masking, cve, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev