CVE-2026-49487 Details
Description
In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred. Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API.
A vulnerability in Apache Airflow versions prior to 3.3.0 allows authenticated users with DAG-scoped task-instance read access to retrieve unmasked secrets, such as provider API keys, from deferred tasks via the REST API task-instance detail and list endpoints. This exposure occurs while the task is deferred, creating a risk of sensitive information leakage.
Users are advised to upgrade to Apache Airflow version 3.3.0 or later, which includes a fix that masks sensitive values in trigger kwargs returned by the API.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/07/6 | CVE | Third Party Advisory |
| https://github.com/apache/airflow/pull/67868 | [email protected] | Issue Tracking |
| https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.3.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | [email protected] |
| Sep 16, 2026 | CVE Modified | CVE |
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | CVE Modified | CVE |
| Jul 7, 2026 | New CVE Received | [email protected] |