Listen to this Post
Apache Airflow’s secrets masker is designed to hide sensitive values—such as passwords, API keys, and tokens—when they are displayed in the web UI. Values stored under known sensitive key names are automatically masked to prevent shoulder-surfing attacks where an attacker might view sensitive information over an administrator’s shoulder.
The masker operates by recursively traversing data structures and applying a depth limit to prevent infinite recursion. When a sensitive value is nested inside a dictionary, the masker descends into it and masks the value appropriately. However, a logic flaw existed in how the masker handled other container types: lists, tuples, and sets.
Specifically, the recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit. If an Airflow Variable held a deeply-nested sensitive value inside one of these containers, the value would be displayed unmasked in the Variables UI. For example, a Variable with a structure like `{“secret”: [“nested”, [“actual_password”]]}` would show the actual password in plain text if the nesting exceeded the depth limit.
This vulnerability is an incomplete-fix follow-up to CVE-2026-42358. The original fix for CVE-2026-42358 made only the dictionary walk unbounded—it failed to address lists, tuples, and sets beyond the depth limit, which remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix are still vulnerable to this residual case and must upgrade to fully resolve the issue.
Importantly, the exposure is limited to the UI. Any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API. The masking is a shoulder-surfing defense for the UI, not an access-control boundary. This means the vulnerability does not disclose data that the user could not otherwise obtain via legitimate API access. However, it weakens the privacy protection in UI interactions, making sensitive data visible to anyone viewing the screen.
DailyCVE Form:
Platform: Apache Airflow
Version: < 3.3.1
Vulnerability: UI secrets unmasked
Severity: MEDIUM (CVSS 4.3)
Date: 2026-08-12
Prediction: 2026-08-20
What Undercode Say:
Analytics of the vulnerability shows that the flaw exists in the `secrets_masker.py` module where the `_mask_value()` function applies recursion depth limits inconsistently across data types. The patch addresses this by ensuring lists, tuples, and sets are traversed with the same unbounded depth logic as dictionaries.
Check current Airflow version airflow version Verify if vulnerable (before 3.3.1) pip show apache-airflow | grep Version Check for existence of the masker fix in source grep -r "recursion-depth" /path/to/airflow/secrets_masker.py
Vulnerable code snippet (simplified)
def _mask_value(value, depth=0):
if depth > MAX_DEPTH:
return value BUG: returns unmasked for lists/tuples/sets
if isinstance(value, dict):
return {k: _mask_value(v, depth+1) for k, v in value.items()}
if isinstance(value, (list, tuple, set)):
BUG: limit not applied correctly beyond depth
return [_mask_value(v, depth+1) for v in value]
return mask(value) if is_sensitive(key) else value
Patch verification - check if fix is applied In Airflow 3.3.1, the fix ensures all containers are traversed curl -s https://raw.githubusercontent.com/apache/airflow/v3-3-stable/airflow/utils/secrets_masker.py | grep -A5 "def _mask_value"
Exploit: (Educational Purposes!)
An authenticated user with access to the Variables UI can trigger the vulnerability by:
1. Creating or accessing an Airflow Variable with a sensitive value nested inside a list, tuple, or set beyond the recursion depth limit.
2. Navigating to the Variables UI (/variables/list/) where the unmasked value is displayed.
3. Viewing the sensitive data in plain text on the screen.
Example variable structure that triggers the flaw:
{
"credentials": [
"api_key",
[
"nested",
[
"actual_secret_value_here"
]
]
]
}
The masker fails to descend into the nested list beyond the depth limit, exposing `”actual_secret_value_here”` unmasked in the UI.
Note: This exploit does not bypass API access controls—the same user could already retrieve the value via GET /api/v1/variables/{variable_key}. The vulnerability only removes UI-level masking.
Protection:
- Upgrade to Apache Airflow version 3.3.1 or later.
- If immediate upgrade is not possible, restrict access to the Variables UI to only trusted administrators.
- Avoid storing highly sensitive values (e.g., root passwords, encryption keys) in deeply nested list/tuple/set structures within Airflow Variables.
- Monitor UI access logs for unauthorized viewing of Variables.
- Apply the patch from GitHub PR 68422 if compiling from source.
Impact:
- Confidentiality: Low impact. Sensitive values may be exposed in the UI to authenticated users who already have API read access.
- Integrity: None. The vulnerability does not allow modification of data.
- Availability: None. No disruption to Airflow services.
- Attack Vector: Network. The attacker must have network access to the Airflow web UI.
- Privileges Required: Low. The attacker must be an authenticated user with access to the Variables UI.
- User Interaction: None. No user interaction is required beyond viewing the UI.
- Exploit Probability (EPSS): 0.26% (19th percentile).
- Affected Versions: All Apache Airflow versions before 3.3.1.
- Fixed Version: Apache Airflow 3.3.1 or later.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
