CVE-2026-48892
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in Apache Airflow exposed per-key secrets-backend overrides (environment variables) as config options that were not masked. An authenticated user with Config read permission could retrieve plaintext secrets-backend credentials (e.g., role_id, secret_id) from the Config API.
Risk Assessment
The organization risks leakage of sensitive credentials for secrets backends (e.g., Vault), potentially leading to unauthorized access to stored secrets and privilege escalation.
Recommendation
Upgrade Apache Airflow to version 3.3.0 or later immediately. Until then, restrict access to the Config API to trusted users only.
Original NVD description (English source)
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.