CVE-2026-48828
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability in the Apache Airflow Bulk Variables API causes the redactor to not receive the variable key, so the `should_hide_value_for_key` check (triggered by secret-suffixed key names like `_password`, `_token`, `_secret`) does not apply to JSON-decodable variable values. An authenticated user with bulk Variable read permission can retrieve plaintext values from JSON variables whose key would otherwise trigger redaction.
Risk Assessment
The organization is at risk of leaking sensitive data stored in Airflow variables with secret-suffixed key names (e.g., `_password`) when values are JSON-typed. An attacker with basic permissions can read these values in plaintext.
Recommendation
Upgrade Apache Airflow to version 3.3.0 or later immediately. If an upgrade is not possible, avoid storing sensitive values in JSON variables with secret-suffixed key names.
Original NVD description (English source)
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).