CVE-2026-86468: Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs

Q: Who can retrieve the exposed secrets?

A user who can read audit events through the event-log API can retrieve the cleartext values, even if that user is denied access to Variables and Connections.

Q: What command inputs may be recorded in cleartext?

Affected examples include a trailing --description on Variable commands, --conn-extra values, and an inline --password supplied to airflow keycloak-auth-manager commands. The masking logic relies on argument position, so supported command shapes can bypass masking.

Q: Does upgrading remove secrets already written to audit logs?

No. Audit-log entries created before the upgrade retain cleartext values; purge affected entries and rotate any secrets contained in them.

Q: What version should be deployed to address the issue?

Upgrade Apache Airflow to version 3.4.0 or later.

Published Nov 9, 2026

Updated

Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing --description on Variable commands, --conn-extra, and the inline --password of airflow keycloak-auth-manager commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API.

Users of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain.

Affected Software

1 affected component

Apache Airflow<3.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade apache-airflow to a version that resolves this vulnerability.
Fixed in 3.4.0
Operational
Purge audit-log entries written before the upgrade that contain cleartext values, and rotate the secrets they contain.

Event History

Nov 9, 2026

CVE Published

via MITRE·09:49 AM

Data Sourced

via MITRE·09:49 AM

DescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionWeakness

Frequently Asked Questions

Who can retrieve the exposed secrets?

A user who can read audit events through the event-log API can retrieve the cleartext values, even if that user is denied access to Variables and Connections.

What command inputs may be recorded in cleartext?

Affected examples include a trailing --description on Variable commands, --conn-extra values, and an inline --password supplied to airflow keycloak-auth-manager commands. The masking logic relies on argument position, so supported command shapes can bypass masking.

Does upgrading remove secrets already written to audit logs?

No. Audit-log entries created before the upgrade retain cleartext values; purge affected entries and rotate any secrets contained in them.

What version should be deployed to address the issue?

Upgrade Apache Airflow to version 3.4.0 or later.

CVE-2026-86468: Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can retrieve the exposed secrets?

What command inputs may be recorded in cleartext?

Does upgrading remove secrets already written to audit logs?

What version should be deployed to address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can retrieve the exposed secrets?

What command inputs may be recorded in cleartext?

Does upgrading remove secrets already written to audit logs?

What version should be deployed to address the issue?