{"id":"CVE-2026-113504","aliases":[],"cve":{"records":[{"id":"CVE-2026-113504","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-20T10:43:30.424Z","published":"2026-11-09T09:21:35.743Z","modified":"2026-11-12T16:02:59.170Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-09T13:04:03.826Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-11-09T10:09:43.538Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T16:02:59.170Z"}],"references":[{"url":"https://github.com/apache/airflow/pull/73793","tags":["patch"],"source":"apache"},{"url":"https://lists.apache.org/thread.html/c0bzrpq913qh7srwdmx0smvt1tgvthrr","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/19","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-497","description":"CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T16:01:44.858289Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext","titleSource":"apache","descriptionSource":"apache","description":"Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.","score":6.5,"severity":"medium","published":"2026-11-09T09:21:35.743Z","modified":"2026-11-12T16:02:59.170Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"2.1.1","status":"affected","lessThan":"3.0.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-113504"},{"vendor":"Apache Software Foundation","name":"Apache Airflow","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.4.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/apache-airflow-core","packageIdentity":{"ecosystem":"PyPI","name":"apache-airflow-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-113504"}],"remediation":[],"references":["https://github.com/apache/airflow/pull/73793","https://lists.apache.org/thread.html/c0bzrpq913qh7srwdmx0smvt1tgvthrr","http://www.openwall.com/lists/oss-security/2026/11/09/19"],"sources":[{"name":"CVE","id":"CVE-2026-113504","modified":"2026-11-12T16:02:59.170Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-113504"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-12T23:58:09.515Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:40:44.398Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T09:40:31.446Z","attemptedAt":"2026-11-09T09:40:31.446Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T09:40:31.451Z","attemptedAt":"2026-11-09T09:40:31.451Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T09:40:30.850Z","attemptedAt":"2026-11-09T09:40:30.850Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T09:40:31.447Z","attemptedAt":"2026-11-09T09:40:31.447Z"}],"evidence":[],"aiSummary":{"text":"Apache Airflow's secrets masker has a weakness that may expose sensitive information. Affected versions, including 2.x and before 3.4.0, may show secrets in cleartext to users who can read task logs or templates. An attacker needs access to these logs or templates to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T13:21:17.175Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-113504"}]}}