Skip to main content
cve.nowby Sazabi
← Vulnerabilities
CVE-2026-86468EUVD-2026-119901

Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs

Exploited
No known exploitation
Fix
Fixed in apache-airflow 3.0.0 · apache-airflow-core 3.4.0
Who is exposed
Not reported

Do first: Upgrade to a fixed version: apache-airflow 3.0.0 · apache-airflow-core 3.4.0.

Published
Last modified
17/100 · provisional
Low (apache)
None on Exploit-DB, Metasploit or GitHub

Summary

Apache Airflow's CLI masks secrets in its audit log by argument position, so some command forms, such as a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands, leave secrets in cleartext. A user who can read audit events but is denied access to Variables and Connections can retrieve those values through the event-log API.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing --description on Variable commands, --conn-extra, and the inline --password of airflow keycloak-auth-manager commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API.

Users of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

cve.now Index

17Pcve.now Index 17 of 100 · methodology v3 · provisional
  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure?/25Unknown. No advisory context yet
  • Reach16/20apache-airflow: 1.5M downloads a week
  • Severity1/10Rated low by apache
  • No patch0/5No signal

What would change the score

  • Would score about 72 if added to CISA KEV
  • Would score about 67 if CISA's SSVC rates exploitation active
  • Would score about 39 if advisories confirm default setups are exposed

How the score works · Rankings

Impact

  • Widely used

    apache-airflow has 1.5m weekly downloads.Source: pypistats.org

    473 packages depend on apache-airflow.Source: deps.dev

What to do

  • Upgrade to a fixed version: apache-airflow 3.0.0 · apache-airflow-core 3.4.0.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. Record last updated

Affected versions

  • fixed in 3.0.0

    Fixed in 3.0.0 (released Apr 22, 2025, 566 days before disclosure).

    The latest release, 3.4.0, is not affected.

  • fixed in 3.4.0

    Fixed in 3.4.0 (released Nov 6, 2026, 3 days before disclosure).

    The latest release, 3.4.0, is not affected.

Evidence 3

  1. Advisory
  2. Patch
  3. Link

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-86468

Is CVE-2026-86468 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by CVE-2026-86468?

apache-airflow (PyPI): before 3.0.0. apache-airflow-core (PyPI): before 3.4.0.Source: cve.now feed data

How do I fix CVE-2026-86468?

Upgrade to a fixed version: apache-airflow 3.0.0 · apache-airflow-core 3.4.0.Source: cve.now feed data

Sources

Related

More vulnerabilities