CVE-2026-48828 Details
Description
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).
A vulnerability exists in the Bulk Variables API of Apache Airflow versions prior to 3.3.0. The issue arises because the API calls the redactor function without including the variable's key. This omission prevents the key-based redaction check from being applied to JSON-decodable variable values. As a result, an authenticated user with permission to read bulk variables could access plaintext values from JSON variables with keys that would normally trigger redaction, such as those ending in '_password', '_token', or '_secret'. This vulnerability affects deployments that use JSON-typed Airflow Variables to store sensitive information under secret-suffixed key names.
Users are advised to upgrade to Apache Airflow version 3.3.0 or later. The fix for this vulnerability has been applied to the main branch after version 3.2.2, but there is no backport available for the 3.2.x series.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/07/2 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/67495 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.3.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | [email protected] |
| Sep 16, 2026 | CVE Modified | CVE |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | CVE Modified | CVE |
| Jul 7, 2026 | New CVE Received | [email protected] |