CVE-2026-50204Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext

Descripción

Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/apache/airflow/pull/68049 patch
• https://github.com/apache/airflow/pull/70759 patch
• https://lists.apache.org/thread.html/1rfswowf30yck0ql4nhnc5vlk854s8jy vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/11/09/4