CVE-2026-48892: Apache Airflow Config API Secrets Leakage Vulnerability
Summary
CVE-2026-48892: Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options. Affects airflow versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Also tracked for
- apache-airflow · PyPI
The same CVE-2026-48892 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) using Python code. Airflow's extensibility and ability to integrate with various data sources make it a popular choice for managing complex data pipelines. However, the Config API has a vulnerability that exposes sensitive secrets backend credentials when configured with per-key environment overrides.
Vulnerability Detail
The vulnerability arises from the Config API in Apache Airflow, which inadvertently exposes per-key secrets-backend overrides as synthetic configuration options. These options are not included in the 'sensitive_config_values' list, leading to a failure in redaction by the masker. As a result, an authenticated user with Config read permissions can access plaintext secrets-backend credentials, such as Vault 'role_id' and 'secret_id'. This could lead to unauthorized access to sensitive data and compromise the security of the deployment.
How To Fix
Minimum fixed version
3.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using per-key environment overrides for secrets backends until they can upgrade to the patched version. Instead, consider using a centralized secrets management approach that does not expose sensitive information through the Config API.
Conclusion
In summary, CVE-2026-48892 highlights a significant vulnerability in Apache Airflow's Config API that can expose sensitive credentials. Users are strongly advised to upgrade to version 3.3.0 or later to mitigate this risk. Until then, implementing workarounds can help protect sensitive information.
See every vulnerability recorded for airflow →
FAQ
CVE-2026-48892 is a vulnerability in Apache Airflow's Config API that allows authenticated users to access plaintext secrets-backend credentials due to improper masking of synthetic configuration options.
Deployments of Apache Airflow that configure secrets backends via per-key environment overrides are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, avoid using per-key environment overrides for secrets backends as a temporary workaround.
The potential consequences include unauthorized access to sensitive secrets-backend credentials, which could lead to data breaches and compromise the security of your workflows.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
