CVE-2026-42358: Apache Airflow Secret Masking Bypass for Deeply Nested JSON Variables

Technical summary

The vulnerability exists in Apache Airflow's Variable response masker, which redacts values associated with secret-pattern key names at response time. The masker implements a recursion depth limit to prevent stack exhaustion during tree traversal of nested JSON Variable values. However, the implementation returns the original nested item without first checking whether its key name matches a sensitive pattern (password, token, secret, api_key, etc.) when that item's depth exceeds the configured recursion cap. This means a Variable with structure like {"outer": {"inner": {"deeply": {"nested": {"password": "secret123"}}}}} may escape masking if the password key sits beyond the depth threshold. The prior fix (CVE-2026-32690) only constrained shallower nesting via max_depth=1 and did not increase the overall recursion limit, leaving the boundary-crossing pattern unpatched for deeper structures.

Business impact

Any Airflow deployment storing sensitive configuration, credentials, or API keys inside nested JSON Variables is at risk if an attacker or malicious insider holds Variable read permissions. Secret leakage could compromise downstream systems, APIs, databases, or external services that those credentials protect. Organizations using Airflow for orchestration of cloud infrastructure, data pipelines, or third-party integrations may find authentication tokens or API keys exposed to unauthorized users. The blast radius depends on secret scope—database passwords or cloud credentials could enable broad lateral movement.

Affected systems

Apache Airflow instances with Variables containing nested JSON structures where sensitive keys (password, token, secret, api_key, and similar patterns) are nested deeper than the masker's recursion depth limit. The vulnerability requires an authenticated UI or API user with Variable read permission; it does not affect unauthenticated access. Any recent Airflow 3.x or 2.x version prior to the recommended patch is likely vulnerable if configuration secrets are stored in Variables rather than external secret backends.

Exploitability

Exploitation requires valid Airflow UI or API credentials with at least Variable read permission—a low bar in many organizations where DAG developers or operators have such access. No interaction or special conditions beyond crafting a nested JSON Variable and reading it back are needed. An attacker need not interact with the Variable; simple read access during normal workflow inspection surfaces the plaintext secrets. This makes the vulnerability straightforward to weaponize for insiders or compromised low-privilege accounts. However, the attack does not affect Variables stored in external secret backends (e.g., HashiCorp Vault, AWS Secrets Manager) if those are properly configured instead of inline JSON storage.

Remediation

Upgrade Apache Airflow to version 3.2.2 or later, which raises the masker's recursion depth limit and ensures key-name checking occurs before returning any nested item, regardless of depth. Organizations already patched for CVE-2026-32690 should treat this as a critical follow-up upgrade. Until patching is complete, audit Variable configurations to identify secrets stored in nested JSON and migrate them to external secret backends (Vault, AWS Secrets Manager, Kubernetes Secrets) using Airflow's connection or Variable reference features. Restrict Variable read permissions to only users and services that require them; use RBAC to segregate access.

Patch guidance

Apply Apache Airflow 3.2.2 or any later 3.x release; verify the patch via the Airflow release notes and security advisories on the Apache Airflow project page. If you are on Airflow 2.x, check the corresponding 2.x patch release timeline from Apache. Test the patch in a staging environment first to ensure no regressions in Variable masking behavior or API responses. After patching, no configuration changes are required for the fix to take effect; the masker will operate with the corrected depth handling on restart.

Detection guidance

Review Airflow Variable configurations (via the Airflow UI, API, or database queries) for any JSON-structured Variables containing keys matching password, token, secret, api_key, or similar patterns. Pay special attention to nested structures more than 2–3 levels deep. Check audit logs for Variable read access by users or service accounts; correlate with the presence of nested-secret Variables to identify potential exposure. Consider implementing a custom audit hook or Variable Serializer in Airflow to log all Variable access and flag reads of deep-nested structures. Monitor outbound API calls or database connections immediately after Variable read events as a sign of credential misuse.

Why prioritize this

Although the CVSS score of 6.5 reflects medium severity, this vulnerability warrants prompt attention because: (1) it is a residual gap in a prior security fix, signaling incomplete remediation; (2) it requires only read access to exploit, which is common in Airflow deployments; (3) plaintext secret exposure can cascade into compromise of downstream infrastructure; (4) it directly contradicts Airflow's documented masking feature, breaking security assumptions operators may rely on. Organizations that believed CVE-2026-32690 was fully addressed should re-evaluate their risk posture.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N score of 6.5 reflects: network-accessible attack surface (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), high confidentiality impact (C:H), and no integrity or availability impact. The score is reasonable for a plaintext secret disclosure affecting authenticated users; it does not account for the likely high business impact of credential compromise. Organizations storing production secrets in Variables should treat this as higher priority than the CVSS alone suggests.

Frequently asked questions