The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.
References
| Link | Resource |
|---|---|
| https://github.com/apache/airflow/pull/67622 | Issue Tracking |
| https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/07/07/4 | Third Party Advisory |
Configurations
History
09 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/apache/airflow/pull/67622 - Issue Tracking | |
| References | () https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/07/07/4 - Third Party Advisory | |
| First Time |
Apache
Apache airflow |
|
| CPE | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* |
07 Jul 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
07 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Jul 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-07 10:16
Updated : 2026-07-09 13:16
NVD link : CVE-2026-48892
Mitre link : CVE-2026-48892
CVE.ORG link : CVE-2026-48892
JSON object : View
Products Affected
apache
- airflow
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor