CVE-2026-49487
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred.
Risk Assessment
The risk involves leakage of sensitive credentials (e.g., API keys) to unauthorized users, potentially leading to unauthorized access to external systems and security breaches for the organization.
Recommendation
Upgrade Apache Airflow to version 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API.
Original NVD description (English source)
In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred. Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API.