Read the docs
TI-2026-39087 Aliases CVE-2026-54183GHSA-g4qj-5vxv-wggf

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Priority LOW 20CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary. This is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed Apache Airflow (Apache Software Foundation): 3.0.0, 3.3.1apache-airflow (PyPI): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflowbefore 3.0.03.0.0Patch availableCNA
ApacheApache Airflow3.0.0 to before 3.3.13.3.1Patch availableCNA
—apache-airflow (PyPI)before 3.3.13.3.1Patch availableGHSA-g4qj-5vxv-wggf
  • Apache Airflow VendorApache Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
  • Apache Airflow VendorApache Affected 3.0.0 to before 3.3.1 Fixed in 3.3.1 Patch available CNA
  • apache-airflow (PyPI) Vendor— Affected before 3.3.1 Fixed in 3.3.1 Patch available GHSA-g4qj-5vxv-wggf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*before 3.3.1VulnerableApache
  • cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* Versions before 3.3.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow (Apache Software Foundation) Fixed in 3.0.0
  • Fix · CNA Apache Airflow (Apache Software Foundation) Fixed in 3.3.1
  • Fix · GHSA-g4qj-5vxv-wggf apache-airflow (PyPI) Fixed in 3.3.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Airflow 3.3.1

    12 records Highest priority Priority MEDIUM 2 MEDIUM, 10 LOW

    Other records, highest priority first

    • TI-2026-47748 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadgetPriority MEDIUM 41
    • TI-2026-41827 Deserialization of untrusted data in Apache AirflowPriority MEDIUM 41
    • TI-2026-47565 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserializationPriority LOW 39
    Show all 12 records →
  • Release ·

    Apache Airflow 3.0.0

    8 records Highest priority Priority LOW 8 LOW

    Other records, highest priority first

    • TI-2026-48479 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill idPriority LOW 33
    • TI-2026-48482 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpointsPriority LOW 29
    • TI-2026-48480 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartextPriority LOW 29
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54183
  2. 2026-10-03 Alias added: GHSA-g4qj-5vxv-wggf
  3. 2026-11-03 Fix available: [email protected], [email protected] · CNA

References

Patch 1

Advisory 3

Other 5

  • TI-2020-10905 Missing authentication in Apache Airflow KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-09638 OS command injection in Apache Airflow KEVCVSS 3.1HIGH 8.8
  • TI-2022-19017 Apache Airflow <2.4.0 has an RCE in a bash example CVSS 3.1HIGH 8.8
  • TI-2021-16140 Apache Airflow: Variable Import endpoint missed authentication check CVSS 3.1CRITICAL 9.8
  • TI-2022-08169 Apache Airflow: RCE in example DAGs CVSS 3.1HIGH 8.8
  • TI-2024-26776 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler CVSS 3.1HIGH 8.8
See all 157 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences