Aller au contenu
en Se connecter
Non notée

CVE-2026-42360 A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g

Description

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the nested-key path.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Airflow 3.0 3.0.0 → < 3.2.2 3.2.2

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Airflow

Les 153 CVE de Apache Airflow →
CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie Non notée CVE-2026-75158 Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter… Non notée CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token,… Non notée CVE-2026-75157 Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of… Non notée
Suivre cette CVE