# CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/584) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-50204-apache-airflow-audit-log-secrets-masker-redacts-by-key-name-only-2efeefb5d08f8f37
Kind: security · Impact: medium

## In brief

- Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column.
- The secrets masker redacted only by key name, so secrets under other keys were persisted unredacted.
- The issue is tracked as CVE-2026-50204 and rated moderate severity; affected versions are Apache Airflow before 3.4.0.

## Why it matters

Anyone with access to Airflow's audit log data could read connection and Variable secrets stored in cleartext, so affected deployments should be upgraded.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow before 3.4.0

## CVEs

- CVE-2026-50204

## Timeline

- 2026-11-08: Vulnerability disclosed on the oss-security list

## Coverage

- [CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext](https://seclists.org/oss-sec/2026/q4/584) — Open Source Security, 2026-11-09

Tags: airflow, security, secrets, audit-logging, cve-2026-50204, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev