CVE-2026-48828

Katalog CVE

CVSS 6.5 · Medium EPSS 0,66%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada apache airflow. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).

Rincian

Terbit di NVD

7 Juli 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc mailing list · advisory vendor
• https://github.com/apache/airflow/pull/67495 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/07/07/2 mailing list · advisory pihak ketiga