PT-2026-56176 · Apache · Apache Airflow

Omkhar Arasaratnam + 1 · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-48828

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0

Description The Bulk Variables API fails to pass the variable's key to the redactor. This prevents the should hide value for key function from identifying secret-suffixed key names, such as * password, * token, or * secret. Consequently, an authenticated user with bulk Variable read permissions can retrieve plaintext values from JSON-decodable variables that should have been redacted.

Recommendations Upgrade to version 3.3.0 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-48828

Affected Products

Apache Airflow

References · 6

• https://github.com/apache/airflow/pull/67495 · Patch
• https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48828 · Security Note
• http://openwall.com/lists/oss-security/2026/07/07/2 · Note
• https://twitter.com/CVEnew/status/2074459519225073967 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074460038379307061 · Twitter Post