CVE-2026-54183: Apache Airflow Information Disclosure Flaw

CVE-2026-54183 Overview

CVE-2026-54183 is an information exposure vulnerability in Apache Airflow's secrets masker. The masker hides values stored under sensitive key names when they render in the web UI. Its recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit. An Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI, because any authenticated user who can view the Variable can already read its full value through the Variables REST API. The masking layer is a shoulder-surfing defense, not an access-control boundary. This issue is an incomplete-fix follow-up to CVE-2026-42358, whose patch only made the dictionary walk unbounded.

Critical Impact
Sensitive values nested inside lists, tuples, or sets beyond the recursion-depth limit render unmasked in the Airflow Variables UI, enabling opportunistic shoulder-surfing by authenticated users.

Affected Products

Apache Airflow versions prior to 3.3.1
Deployments that previously applied the CVE-2026-42358 fix but did not upgrade further
Any Airflow deployment storing Variables containing deeply-nested lists, tuples, or sets under sensitive key names

Discovery Timeline

2026-08-12 - CVE-2026-54183 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-54183

Vulnerability Analysis

Apache Airflow's secrets masker inspects Variable values before they render in the UI. When it encounters a key name it considers sensitive, it replaces the value with a redacted placeholder. To handle nested structures, the masker walks the value recursively up to a fixed depth limit. The prior fix for CVE-2026-42358 removed the depth limit for dictionary traversal but left the limit in place for lists, tuples, and sets. A Variable containing a sensitive value buried inside nested list, tuple, or set structures beyond that depth bypasses redaction and renders in plaintext in the Variables UI [CWE-200].

The practical impact is bounded. Airflow's Variables REST API returns the same values without masking to any user who can already view them in the UI. The masker exists to prevent casual observation of on-screen secrets, not to enforce authorization. Operators who relied on UI redaction for demos, screen-shares, or shared workstations lose that protection for the affected data shapes.

Root Cause

The root cause is an incomplete fix in the recursion logic of the secrets masker. The previous patch removed the depth bound for dict traversal but did not extend the same behavior to list, tuple, and set collections. Values nested inside those iterables beyond the recursion-depth threshold are returned unmodified rather than passed back through the redaction routine.

Attack Vector

An authenticated Airflow user browses to the Variables UI and views a Variable whose value contains sensitive data nested inside lists, tuples, or sets deeper than the masker's recursion limit. The sensitive value renders in plaintext instead of being redacted. Exploitation requires low-privilege authenticated UI access. See the upstream pull request and the Apache mailing list thread for the fix and disclosure details.

Detection Methods for CVE-2026-54183

Indicators of Compromise

Airflow Variables containing deeply-nested lists, tuples, or sets under sensitive key names such as password, secret, token, or api_key
Web-server access logs showing repeated GET /variable/list/ or Variable detail views by non-administrative accounts
UI screenshots or screen recordings that expose unredacted sensitive values inside nested collection structures

Detection Strategies

Enumerate all Airflow Variables and inspect their structure for sensitive keys stored inside list, tuple, or set values
Compare rendered UI output against expected redaction to identify Variables where masking silently fails
Audit Airflow version inventory to flag deployments running versions older than 3.3.1

Monitoring Recommendations

Track authentication and Variable-view events in Airflow webserver logs and forward them to a centralized log store
Alert on unusual volumes of Variable read activity from accounts that do not routinely need Variable access
Review Airflow role assignments to confirm that Variable visibility aligns with least-privilege intent

How to Mitigate CVE-2026-54183

Immediate Actions Required

Upgrade Apache Airflow to version 3.3.1 or later
Inventory Variables that store sensitive data inside nested lists, tuples, or sets and restructure them where feasible
Restrict UI access to Variables to only those roles that require it
Rotate any secrets that may have been displayed unmasked in shared or recorded UI sessions

Patch Information

The fix extends the unbounded recursion behavior from dict traversal to list, tuple, and set traversal in the secrets masker. Upgrade to apache-airflow 3.3.1 or later. Deployments that already applied the CVE-2026-42358 fix must still upgrade to address this residual case. See the GitHub pull request for the code change.

Workarounds

Move sensitive values out of Airflow Variables and into a dedicated secrets backend such as HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager
Avoid storing secrets inside nested list, tuple, or set structures under sensitive key names
Limit the Variables permission to administrative roles until the upgrade is applied

bash

# Upgrade Apache Airflow to a patched release
pip install --upgrade "apache-airflow>=3.3.1"

# Verify the installed version
airflow version