Information disclosure in Apache Airflow
CVE-2026-48892
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.
Vulnerability class: Information Disclosure
EPSS: 0.004 (34.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Airflow
- Apache Software Foundation Airflow — versions 0
Weakness classification (CWE)
References
- security@apache.org (patch, Issue Tracking)
- security@apache.org (vendor-advisory, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
Frequently asked questions
- What is CVE-2026-48892?
- CVE-2026-48892 is a medium-severity vulnerability in Apache Airflow, classified under Information Disclosure. CVSS score: 6.5/10. Published 2026-07-07.
- How severe is CVE-2026-48892?
- Medium severity. CVSS v3 base score is 6.5 out of 10.