CVE-2026-50204

Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

• https://github.com/apache/airflow/pull/68049
• https://github.com/apache/airflow/pull/70759

• https://github.com/apache/airflow/pull/68049
• https://github.com/apache/airflow/pull/70759
• https://lists.apache.org/thread.html/1rfswowf30yck0ql4nhnc5vlk854s8jy
• http://www.openwall.com/lists/oss-security/2026/11/09/4

• MEDIUMCVE-2025-7203
• HIGHCVE-2026-100288
• MEDIUMCVE-2026-100581PoC
• MEDIUMCVE-2026-100862PoC
• UNSCOREDCVE-2026-102368
• UNSCOREDCVE-2026-102539PoC
• HIGHCVE-2026-103096
• HIGHCVE-2026-103097

Related by shared AI tags and CWE weakness class. Browse the full archive.