# CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/599) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-113504-apache-airflow-secrets-masker-pattern-based-masking-bounded-at-d-240c8b7177de5d62
Kind: security · Impact: medium

## In brief

- Apache Airflow's secrets masker stops descending into nested structures after five levels.
- Secrets registered with the masker that sit deeper than that are returned in cleartext.
- The oss-security post lists the severity as moderate and affects Apache Airflow versions before 3.4.0.

## Why it matters

Secrets such as connection credentials nested deeper than five levels may be shown unmasked where masking is expected, exposing them to anyone who can read that output.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow before 3.4.0

## CVEs

- CVE-2026-113504

## Timeline

- 2026-11-08: Vulnerability posted to the oss-security mailing list by Rahul Vats

## Coverage

- [CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext](https://seclists.org/oss-sec/2026/q4/599) — Open Source Security, 2026-11-09

Tags: airflow, security, secrets, masking, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev