Exposure is limited to users who can read task logs, rendered template fields, or API responses and are not otherwise authorized to view the credentials. The affected values may originate from a Connection's extra fields or from a Variable.
The issue applies when sensitive values are stored under camelCase keys, including privateKey, connectionString, webhookUrl, or accessKey. Airflow versions before 3.4.0 only matched sensitive key names in snake_case form for masking.
Review task logs, rendered template fields, and API responses accessible to lower-privileged users for cleartext values associated with camelCase sensitive keys. Also identify Connections and Variables that store credentials under those key names.
Upgrade Apache Airflow to version 3.4.0 or later. The provided information does not specify a workaround for installations that cannot yet upgrade.