CVE-2026-48828: Apache Airflow Bulk Variables API Redaction Bypass – Secret Exposure in JSON Variables

Technical summary

The Bulk Variables API in Apache Airflow calls its value-redaction function without providing the variable key as context. Airflow's redaction logic includes a key-based check (`should_hide_value_for_key`) that identifies secret-related variable names via suffix matching (e.g., `*_password`, `*_token`, `*_secret`). Because the bulk API omits the key during redaction, this check cannot execute, and JSON-decodable variable values pass through unredacted. An authenticated user with bulk Variable read permission can then retrieve plaintext sensitive values from variables whose keys would ordinarily trigger redaction. The vulnerability is specific to JSON variables; non-JSON variables and single-variable retrieval pathways appear unaffected. The fix involves passing the variable key to the redactor so the key-based check can function as designed.

Business impact

Organizations running Apache Airflow may face exposure of secrets stored as JSON variables in Airflow's Variable store. This could compromise database credentials, API tokens, service authentication material, or other sensitive configuration stored under secret-suffixed key names. The impact is limited to users with authenticated bulk Variable read access (typically platform operators, DAG developers, or administrative staff), but the exposure of plaintext secrets could enable lateral movement, unauthorized service access, or data exfiltration. Deployments that rely on Airflow's secret-naming conventions for compliance or defense-in-depth are particularly at risk.

Affected systems

Apache Airflow versions up to and including 3.2.2 are vulnerable. The fix is included in Apache Airflow 3.3.0 and later versions. Versions prior to 3.2.0 have not been identified as receiving a backport; upgrading to 3.3.0 or later is the primary remediation path. Affected deployments are those storing sensitive values in JSON-typed Airflow Variables under secret-suffixed key names and granting authenticated users bulk Variable read permissions.

Exploitability

Exploitation requires authentication—an attacker must have an active account or credential for Airflow with the 'bulk Variable read' permission. The attack surface is the Airflow UI or REST API bulk variable endpoint. Once authenticated, the exploit is trivial: a user simply queries bulk variables and inspects JSON values that would otherwise be redacted. No complex steps, special network positioning, or privilege escalation are necessary. However, the attacker's actions may be logged, and the theft is confined to users with existing read access; external, unauthenticated exploitation is not possible.

Remediation

Upgrade to Apache Airflow 3.3.0 or later. There is no published patch for the 3.2.x branch; users on 3.2.2 or earlier must move to 3.3.0. Verify with your Apache Airflow release notes and vendor advisory that your version includes the fix. As an interim measure, review and restrict bulk Variable read permissions to only those users who require it, and audit recent Variable access logs for any suspicious bulk queries. Consider migrating highly sensitive secrets from JSON variables to dedicated secret-management systems or Airflow's SecretBackend integrations to reduce reliance on Airflow's built-in redaction alone.

Patch guidance

Upgrade to apache-airflow version 3.3.0 or later. The fix was merged to the main branch after 3.2.2 release and is not available as a backport for the 3.2.x series. Verify the applied version by checking your Airflow instance version string (visible in the WebUI footer or via `airflow version` CLI). Test the upgrade in a non-production environment first to confirm compatibility with your DAGs and custom plugins. After upgrading, spot-check bulk Variable API responses to confirm that secret-suffixed JSON variables are properly redacted.

Detection guidance

Review Airflow audit logs and API access logs for bulk Variable queries issued by authenticated users. Look for repeated or bulk requests to the `/api/v1/variables` endpoint (or equivalent UI bulk fetch operations) within a short timeframe. Examine which users hold the 'bulk Variable read' permission and whether their access patterns are consistent with their stated roles. If you suspect exposure, audit the contents of JSON-typed variables with secret-related key names (e.g., `db_password`, `api_token`) in your Airflow Variable store. Rotate any secrets that were stored in such variables during the window before you can patch or restrict access.

Why prioritize this

Although the CVSS score of 6.5 is in the MEDIUM range, organizations storing secrets in Airflow Variables should prioritize this patch. The vulnerability is easy to exploit by anyone with a legitimate account, requires no external network access, and directly exposes plaintext credentials. Airflow is often deployed in data-centric environments where DAG developers and operators have broad access; the presence of such users with read permissions increases risk. The fact that no 3.2.x patch is offered means there is a forced upgrade path, which may justify near-term scheduling. Organizations not storing secrets in JSON Airflow Variables, or those using dedicated secret-management backends, face lower immediate risk but should still plan an upgrade within a standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible API (AV:N) with low attack complexity (AC:L), requiring authentication (PR:L), no user interaction (UI:N), a single security domain (S:U), and high confidentiality impact (C:H) with no integrity or availability impact. The score appropriately captures that an authenticated, low-privileged user can gain high-confidence access to plaintext secrets. The score does not reflect the operational severity in Airflow-heavy environments where this data might unlock further attacks; organizations should apply their own risk context regarding the sensitivity of secrets and the trustworthiness of bulk Variable readers.

Frequently asked questions