PT-2026-56180 · Apache · Apache Airflow

Andrew Rukin + 1 · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-49487

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0

Description The REST API task-instance detail and list endpoints return a deferred task's trigger kwargs without masking. This allows any authenticated user with DAG-scoped task-instance read access to view sensitive information, such as provider API keys, in clear text while the task is deferred.

Recommendations Upgrade to version 3.3.0 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-49487

Affected Products

Apache Airflow

References · 6

• https://github.com/apache/airflow/pull/67868 · Patch
• https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49487 · Security Note
• https://twitter.com/infoflowcloud/status/2074460012382970175 · Twitter Post
• https://twitter.com/CVEnew/status/2074459517765427233 · Twitter Post
• http://openwall.com/lists/oss-security/2026/07/07/6 · Note