SecurityFan score 21 · Tier C
CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext
The Brief
- Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column.
- The secrets masker redacted only by key name, so secrets under other keys were persisted unredacted.
- The issue is tracked as CVE-2026-50204 and rated moderate severity; affected versions are Apache Airflow before 3.4.0.
Why it matters
Anyone with access to Airflow's audit log data could read connection and Variable secrets stored in cleartext, so affected deployments should be upgraded.
Who’s affected
- Apache Airflow users running versions before 3.4.0
What to do
- Upgrade Apache Airflow to 3.4.0 or later
- Apache Airflow before 3.4.0
- CVE-2026-50204
- #airflow
- #security
- #secrets
- #audit-logging
- #cve-2026-50204
- #vulnerability
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on…
Timeline
Vulnerability disclosed on the oss-security list
Open Source Security
CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext