PUBLISHED
2026-07-07 10:16
MODIFIED
2026-07-07 10:16
EPSS (Prob. Exploit)
0.66%
Top 48.8%
> DESCRIPTION
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key
AFFECTED PACKAGES:
Unknown / Unknown
2451 versions affected
ALIASES:
BIT-airflow-2026-48828
> HISTORIQUE DES MODIFICATIONS
Première apparition
07/07/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Total des modifications: 1
Dernière mise à jour: 3 months ago