{"id":"CVE-2026-111452","aliases":[],"cve":{"records":[{"id":"CVE-2026-111452","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-16T04:01:34.801Z","published":"2026-11-09T09:12:05.040Z","modified":"2026-11-12T14:55:49.574Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-09T13:04:43.990Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-11-09T10:09:36.852Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T14:55:49.574Z"}],"references":[{"url":"https://github.com/apache/airflow/pull/74840","tags":["patch"],"source":"apache"},{"url":"https://lists.apache.org/thread.html/n0qggmo6o10hxojqr26gp4b2fqjpzzk2","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/15","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T14:55:32.691442Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list","titleSource":"apache","descriptionSource":"apache","description":"Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses. A user who can read task logs or rendered templates, but is not meant to see those credentials, could read them in cleartext. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.","score":6.5,"severity":"medium","published":"2026-11-09T09:12:05.040Z","modified":"2026-11-12T14:55:49.574Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"2.1.0","status":"affected","lessThan":"3.0.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111452"},{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.4.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow-core","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111452"}],"remediation":[],"references":["https://github.com/apache/airflow/pull/74840","https://lists.apache.org/thread.html/n0qggmo6o10hxojqr26gp4b2fqjpzzk2","http://www.openwall.com/lists/oss-security/2026/11/09/15"],"sources":[{"name":"CVE","id":"CVE-2026-111452","modified":"2026-11-12T14:55:49.574Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111452"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-12T21:54:00.080Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:20:33.177Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T09:35:33.289Z","attemptedAt":"2026-11-09T09:35:33.289Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T09:35:33.092Z","attemptedAt":"2026-11-09T09:35:33.092Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T09:35:33.134Z","attemptedAt":"2026-11-09T09:35:33.134Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T09:35:33.029Z","attemptedAt":"2026-11-09T09:35:33.029Z"}],"evidence":[],"aiSummary":{"text":"Apache Airflow's secrets masker does not match camelCase key names, potentially exposing credentials in task logs, template fields, or API responses to users with read access. Affected versions include Apache Airflow 2.x and versions prior to 3.4.0. A user with read access to task logs or templates could read credentials in cleartext.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T13:21:04.341Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111452"}]}}