CVE-2026-49487

Katalog CVE

CVSS 6.5 · Medium EPSS 0,66%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada apache airflow. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred. Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API.

Rincian

Terbit di NVD

7 Juli 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4 advisory vendor
• http://www.openwall.com/lists/oss-security/2026/07/07/6 advisory pihak ketiga
• https://github.com/apache/airflow/pull/67868 issue tracking