SecurityFan score 63 · Tier A
CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
The Brief
- Apache Airflow's secrets masker stops descending into nested structures after five levels.
- Secrets registered with the masker that sit deeper than that are returned in cleartext.
- The oss-security post lists the severity as moderate and affects Apache Airflow versions before 3.4.0.
Why it matters
Secrets such as connection credentials nested deeper than five levels may be shown unmasked where masking is expected, exposing them to anyone who can read that output.
Who’s affected
- Apache Airflow users running versions before 3.4.0
What to do
- Upgrade Apache Airflow to 3.4.0 or later
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection…
Timeline
Vulnerability posted to the oss-security mailing list by Rahul Vats
Open Source Security
CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext