CVE-2026-48892: Apache Airflow exposes secrets backend credentials through the Config API
(updated )
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID and AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID) as synthetic config options whose option names were not in sensitive_config_values, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault role_id / secret_id, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to apache-airflow 3.3.0 or later.
References
- github.com/advisories/GHSA-9933-5rrp-mfwx
- github.com/apache/airflow/commit/f0f978d2736891a2f9e9d2954e87fc358e1ef4e3
- github.com/apache/airflow/pull/67622
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2087.yaml
- lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk
- nvd.nist.gov/vuln/detail/CVE-2026-48892
Code Behaviors & Features
Detect and mitigate CVE-2026-48892 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →