CVE-2026-65017: Apache Airflow Information Disclosure

CVE-2026-65017 Overview

CVE-2026-65017 is an information disclosure vulnerability in Apache Airflow's Config API affecting multi-team deployments. The secrets masker fails to normalize team-prefixed configuration sections before applying sensitivity checks. As a result, an authenticated user holding only configuration-read (Viewer) access can retrieve team-scoped Celery broker URLs in cleartext, including embedded credentials, while the equivalent global option is correctly masked. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
An authenticated Viewer with no prior access to broker credentials can extract team-scoped Celery broker URLs, including embedded usernames and passwords, through the Config API.

Affected Products

Apache Airflow multi-team deployments with the Config API exposed
Apache Airflow 3.3.0 (patched for CVE-2026-48828 and CVE-2026-48892 but still vulnerable to this team-scoped variant)
Any Apache Airflow release prior to 3.3.1 that supports multi-team mode

Discovery Timeline

2026-08-12 - CVE-2026-65017 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65017

Vulnerability Analysis

Apache Airflow's secrets masker inspects configuration keys against a list of sensitive section and option names before returning values through the Config API. In multi-team mode, Airflow supports team-scoped configuration sections that prefix the base section name with a team identifier. The masker performs its sensitivity comparison against only the base section and option names and does not strip or normalize the team prefix before matching.

When a Viewer queries the Config API for a team-scoped celery broker URL, the masker does not recognize the prefixed section as sensitive. Airflow returns the raw value, including credentials embedded in the URL. The equivalent global celery.broker_url option is correctly masked, which made the exposure gap difficult to notice during earlier remediation of related CVEs.

Root Cause

The root cause is an incomplete input normalization step in the secrets masker. The masker's sensitivity check matches on literal base section names such as celery but does not account for team-prefixed variants generated in multi-team deployments. Because normalization occurs after the sensitivity check rather than before, prefixed sections bypass the masking logic entirely.

Attack Vector

Exploitation requires an authenticated account with configuration-read permissions and network access to the Config API on a multi-team Airflow deployment. The attacker issues a standard Config API request targeting a team-scoped section such as a team-prefixed celery block. The API responds with the broker URL in cleartext, exposing credentials that can be reused against the Celery broker or downstream systems.

This vulnerability is distinct from CVE-2026-48828 and CVE-2026-48892. Operators who upgraded to apache-airflow 3.3.0 to remediate those two issues remain exposed to the team-scoped variant. Technical details are available in the Apache Airflow Pull Request 70755 and the Apache mailing list disclosure.

Detection Methods for CVE-2026-65017

Indicators of Compromise

Config API requests from Viewer-role accounts targeting team-scoped sections, particularly team-prefixed celery blocks
Config API responses containing cleartext credentials in broker URLs (for example, amqp://user:password@host)
Anomalous authentications to the Celery broker originating from hosts or accounts not associated with legitimate Airflow workers

Detection Strategies

Enable Apache Airflow audit logging for Config API access and alert on requests to team-scoped configuration sections from accounts with only read permissions
Correlate Config API access events with subsequent Celery broker authentications to identify credential reuse
Review historical Config API access logs against the vulnerable version window to identify potential prior disclosure

Monitoring Recommendations

Monitor Airflow webserver access logs for /api/v1/config requests, particularly with query parameters referencing team-prefixed sections
Track authentication events on Celery broker infrastructure (RabbitMQ, Redis) for connections from unexpected client hosts
Alert on new or unusual account activity holding the Viewer role in multi-team Airflow deployments

How to Mitigate CVE-2026-65017

Immediate Actions Required

Upgrade Apache Airflow to version 3.3.1 or later, which normalizes team-scoped sections before applying the secrets masker
Rotate all Celery broker credentials referenced in team-scoped configuration sections on affected deployments
Audit Viewer-role assignments in multi-team Airflow deployments and revoke unnecessary configuration-read access

Patch Information

Apache has released apache-airflow 3.3.1, which normalizes team-scoped section names before the sensitivity check in the secrets masker. This fix is separate from the remediation delivered in 3.3.0 for CVE-2026-48828 and CVE-2026-48892. Deployments upgraded to 3.3.0 remain vulnerable and must upgrade to 3.3.1 or later. See the upstream patch in Pull Request 70755 for implementation details.

Workarounds

Disable the Config API by setting expose_config = False in the [webserver] section of airflow.cfg until patching is complete
Remove the configuration-read permission from the Viewer role and restrict Config API access to Administrator accounts only
Store Celery broker credentials in an external secrets backend (for example, HashiCorp Vault or AWS Secrets Manager) rather than inline in team-scoped configuration values

bash

# Configuration example: disable Config API exposure in airflow.cfg
[webserver]
expose_config = False

# Alternatively, restrict to non-sensitive keys only
# expose_config = non-sensitive-only