Skip to content
Heist/ feed
MediumFix available

Apache Airflow Config API exposes team-scoped sensitive configuration values

Type: advisorySource: OSV1 source record

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

Announced Source revision 1
Original source ↗

GHSA-c56v-8w4g-3mfm

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-c56v-8w4g-3mfm

apache-airflow

Source reference: /affected/0/package/name

Affected versions
3.3.0

Source reference: /affected/0/versions

3.3.1rc1

Source reference: /affected/0/versions

3.3.1rc2

Source reference: /affected/0/versions

Fixed versions
3.3.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "3.3.0"
          },
          {
            "fixed": "3.3.1"
          }
        ]
      }
    ],
    "package": {
      "name": "apache-airflow",
      "purl": "pkg:pypi/apache-airflow",
      "ecosystem": "PyPI"
    },
    "versions": [
      "3.3.0",
      "3.3.1rc1",
      "3.3.1rc2"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-c56v-8w4g-3mfm/GHSA-c56v-8w4g-3mfm.json"
    }
  }
]
Related CVEs
CVE-2026-65017

Source reference: /aliases

Publisher severity

medium

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-65017 · Medium

airflow

Event
#72776 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement