CVE-2026-48892 Details
Description
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.
A vulnerability in the Config API of Apache Airflow prior to version 3.3.0 allows for the unintentional exposure of per-key secrets backend credentials. This issue arises because environment variable overrides for secrets backends were presented as synthetic config options that were not marked as sensitive, leading to a failure in redaction by the config masker. As a result, an authenticated user with permission to read the config could access plaintext credentials, such as Vault role IDs and secret IDs, from the Config API. The vulnerability affects deployments that use per-key environment overrides to configure secrets backends.
Users are advised to upgrade to Apache Airflow version 3.3.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/07/4 | CVE | Third Party Advisory |
| https://github.com/apache/airflow/pull/67622 | [email protected] | Issue Tracking |
| https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.3.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | [email protected] |
| Sep 16, 2026 | CVE Modified | CVE |
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | CVE Modified | CVE |
| Jul 7, 2026 | New CVE Received | [email protected] |