CVE-2026-48892: Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID) as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault roleid / secretid, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to apache-airflow 3.3.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48892?
CVE-2026-48892 has a medium severity level with a CVSS score of 6.5.
How do I fix CVE-2026-48892?
To mitigate CVE-2026-48892, ensure that sensitive configuration values are not exposed in the Config API.
What impact does CVE-2026-48892 have on Apache Airflow?
CVE-2026-48892 could allow an attacker to leak per-key secrets information, potentially compromising sensitive data.
Which versions of Apache Airflow are affected by CVE-2026-48892?
CVE-2026-48892 affects all versions of Apache Airflow prior to the fix implemented in the latest release.
How can I identify if my Apache Airflow setup is vulnerable to CVE-2026-48892?
You can check for the presence of exposed per-key secrets-backend overrides in your Apache Airflow Config API settings.