PT-2026-45372 · Apache · Apache Airflow

Jarek Potiuk + 1 · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-42360

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description A bug in the rendered-template field handling allows the bypass of nested sensitive-key masking. When a rendered field exceeds the [core] max templated field length limit, the software stringifies the structure before redaction, which removes the nested key context and results in plaintext values being persisted into rendered fields. This affects deployments where DAG authors pass structured JSON to operators containing nested sensitive keys such as password, token, secret, or api key. An authenticated UI or API user with permissions to read rendered template fields can harvest these secret values.

Recommendations Update to version 3.2.2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-42360

PYSEC-2026-172

Affected Products

Apache Airflow

References · 5

• https://github.com/apache/airflow/pull/65906 · Patch
• https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42360 · Security Note
• https://t.me/CVEtracker/55453 · Telegram Post