CVE-2026-45192— Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | < 3.2.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45192
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response
Source: CVE Program / CVE List V5
Vulnerability Description
A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's `extra` field.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Airflow 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Airflow是美国阿帕奇（Apache）基金会的一套具有创建、管理和监控工作流程功能的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow 3.2.2之前版本存在安全漏洞，该漏洞源于REST API端点返回连接extra JSON blob中的秘密，可能导致经过身份验证的用户检索未列入白名单的字段中的秘密。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 ~ 3.2.2 | - |
II. Public POCs for CVE-2026-45192
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45192
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45192 (1)
Mailing List Discussions for CVE-2026-45192 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-01 · 28 CVEs total
| CVE-2026-44825 | 8.1 HIGH | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users |
| CVE-2026-48827 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | |
| CVE-2026-49328 | Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF | |
| CVE-2026-49361 | Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | |
| CVE-2026-40961 | Apache Airflow: Open Redirect Bypass Vulnerability | |
| CVE-2026-40963 | Apache Airflow: DAG authorization bypass on /ui/structure/structure_data | |
| CVE-2026-41014 | Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints | |
| CVE-2026-49267 | Apache Airflow: No certificate validation on SMTP STARTTLS connections | |
| CVE-2026-41017 | Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-termin | |
| CVE-2026-41084 | Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation | |
| CVE-2026-42252 | Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user patter | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | |
| CVE-2026-35563 | Apache Directory LDAP API: LDAP client implementation does not verify if the server certif | |
| CVE-2026-42359 | Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDD | |
| CVE-2026-45360 | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | |
| CVE-2026-45426 | Apache Airflow: Log server JWT authorization bypass via Python lstrip() character strippin | |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Airflow
- CVE-2026-59244
Apache Airflow: Secrets masker: `var.json` Variable values n - CVE-2026-58076
Apache Airflow: Unguarded import_string() of airflow_exc_ser - CVE-2026-59242
Apache Airflow: Arbitrary airflow.* class instantiation on t - CVE-2026-54183
Apache Airflow: Airflow Variables were not masked in the UI - CVE-2026-67260
Apache Airflow: DAG-author remote code execution on the Sche
Same vendor: Apache Software Foundation
- CVE-2026-34884
Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and - CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v
Same weakness: CWE-200
- CVE-2026-53959
4gaBoards: Mass Information Disclosure (Internal PII Leakage - CVE-2026-76041
Chrome < 151.0.7922.169 信息泄露漏洞 - CVE-2026-62988
Froxlor: Credential and 2FA secret disclosure via Froxlor AP - CVE-2026-63640
MagicMirror socket payload secret placeholder expansion can - CVE-2026-75915
CodeWhale before 0.8.64 Environment Variable Leak via js_exe
V. Comments for CVE-2026-45192
No comments yet