CVE-2026-49487— Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49487
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred. Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 ~ 3.3.0 | - |
II. Public POCs for CVE-2026-49487
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49487
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-49487 (1)
Mailing List Discussions for CVE-2026-49487 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-07 · 6 CVEs total
| CVE-2026-33264 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerial | |
| CVE-2026-48828 | Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called wit | |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagS | |
| CVE-2026-48891 | Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via tri | |
| CVE-2026-48892 | Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthet |
IV. Related Vulnerabilities
Same product: Apache Airflow
- CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted - CVE-2026-48828
Apache Airflow: Bulk JSON Variables bypass should_hide_value - CVE-2026-49296
Apache Airflow: Per-DAG read bypass discloses co-located DAG - CVE-2026-48891
Apache Airflow: /ui/dependencies scheduling graph leaks unre - CVE-2026-48892
Apache Airflow: Config API leaks per-key secrets backend kwa
Same vendor: Apache Software Foundation
- CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted - CVE-2026-48828
Apache Airflow: Bulk JSON Variables bypass should_hide_value - CVE-2026-49296
Apache Airflow: Per-DAG read bypass discloses co-located DAG - CVE-2026-48891
Apache Airflow: /ui/dependencies scheduling graph leaks unre - CVE-2026-48892
Apache Airflow: Config API leaks per-key secrets backend kwa
Same weakness: CWE-200
- CVE-2026-48828
Apache Airflow: Bulk JSON Variables bypass should_hide_value - CVE-2026-48891
Apache Airflow: /ui/dependencies scheduling graph leaks unre - CVE-2026-48892
Apache Airflow: Config API leaks per-key secrets backend kwa - CVE-2026-53647
FOSSBilling vulnerable to unauthenticated API key configurat - CVE-2026-53643
FOSSBilling allows low-privileged staff accounts to perform
V. Comments for CVE-2026-49487
No comments yet