BIT-airflow-2026-42360

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2026-42360.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-airflow-2026-42360
Aliases
Published
2026-06-05T05:40:42.523Z
Modified
2026-06-05T07:56:01.018274708Z
Summary
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking
Details

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested password / token / secret / api_key keys inside a JSON template structure) to be bypassed when the rendered field exceeded [core] max_templated_field_length: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into rendered_fields. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of CWE-200 previously addressed for the user-registered mask_secret() patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to apache-airflow 3.2.2 or later to cover the nested-key path.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / airflow

Package

Name
airflow
Purl
pkg:bitnami/airflow

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2026-42360.json"