{"id":"CVE-2026-50204","published":"2026-11-09T10:17:10.207","lastModified":"2026-11-10T21:12:56.770","description":"Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-312"],"vendors":[],"products":[],"references":[{"url":"https://github.com/apache/airflow/pull/68049","tags":[]},{"url":"https://github.com/apache/airflow/pull/70759","tags":[]},{"url":"https://lists.apache.org/thread.html/1rfswowf30yck0ql4nhnc5vlk854s8jy","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/4","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/airflow/pull/68049","tags":[]},{"url":"https://github.com/apache/airflow/pull/70759","tags":[]}],"hasPoc":true,"ai":null}