CVE-2026-42360: Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking
A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested password / token / secret / apikey keys inside a JSON template structure) to be bypassed when the rendered field exceeded [core] maxtemplatedfieldlength: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into renderedfields. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of CWE-200 previously addressed for the user-registered masksecret() patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to apache-airflow 3.2.2 or later to cover the nested-key path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Airflow (apache-airflow)to a version that resolves this vulnerability.Fixed in 3.2.2 - Configuration
Lower [core] max_templated_field_length to prevent rendered template field truncation that can bypass nested sensitive-key masking and leads to plaintext being persisted in rendered_fields.
Apache Airflow [core] max_templated_field_length = (reduce below the length that triggers truncation/redaction bypass)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42360?
The severity of CVE-2026-42360 is rated as medium with a score of 6.5.
How do I fix CVE-2026-42360?
You can fix CVE-2026-42360 by applying the available patch from the Apache Airflow repository.
What is the risk associated with CVE-2026-42360?
CVE-2026-42360 has a risk rating of 40, indicating a significant concern that needs to be addressed.
What type of vulnerability is CVE-2026-42360?
CVE-2026-42360 is classified as an information leak due to its ability to bypass sensitive-key masking.
When was CVE-2026-42360 published?
CVE-2026-42360 was published on May 31, 2026.