In Apache Airflow before 3.3.0, the REST API task-instance detail and list
endpoints returned a deferred task's trigger kwargs without masking. When a
deferred operator passed a secret (for example a provider API key) into its
trigger, any authenticated user with DAG-scoped task-instance read access for
that DAG could read that secret in clear text while the task was deferred.
Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive
values in trigger kwargs returned by the API.
References
| Link | Resource |
|---|---|
| https://github.com/apache/airflow/pull/67868 | Issue Tracking |
| https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/07/07/6 | Third Party Advisory |
Configurations
History
09 Jul 2026, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/apache/airflow/pull/67868 - Issue Tracking | |
| References | () https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4 - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/07/07/6 - Third Party Advisory | |
| CPE | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* | |
| First Time |
Apache
Apache airflow |
07 Jul 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
07 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Jul 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-07 10:16
Updated : 2026-07-09 13:17
NVD link : CVE-2026-49487
Mitre link : CVE-2026-49487
CVE.ORG link : CVE-2026-49487
JSON object : View
Products Affected
apache
- airflow
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor