CVE-2026-42358

A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like `password`, `token`, `secret`, `api_key`) to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nested item before checking the sensitive key name. An authenticated UI/API user with Variable read permission could harvest plaintext secret values stored under sensitive keys nested deep enough to exceed the masker's depth cap. Affects deployments that store sensitive values inside deeply-nested JSON Variables. This is a residual gap in the fix for CVE-2026-32690 (which covered shallower nesting via `max_depth=1`); the depth-limit boundary itself was not raised, so the same key-name bypass pattern reappears beyond the recursion cap. Users who already upgraded for CVE-2026-32690 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the deep-nesting path.

• CWE-200

• https://github.com/apache/airflow/pull/65912Issue Tracking, Patch
• https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2omMailing List, Vendor Advisory

Published

Jun 1, 2026

Last Modified

Jul 21, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42351pygeoapi is a Python server implementation of the OGC API su…7.5
• CVE-2026-42352pygeoapi is a Python server implementation of the OGC API su…8.6
• CVE-2026-42353i18next-http-middleware is a middleware to be used with Node…8.2
• CVE-2026-42354Sentry is an error tracking and performance monitoring tool.…9.8
• CVE-2026-42355NanaZip is an open source file archive. From 5.0.1252.0 to b…5.5
• CVE-2026-42357Incorrect Authorization vulnerability allows users to access…6.5
• CVE-2026-42359A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2…8.8
• CVE-2026-4236A security vulnerability has been detected in itsourcecode O…7.3
• CVE-2026-42360A bug in Apache Airflow's rendered-template field handling c…6.5
• CVE-2026-42363An insufficient encryption vulnerability exists in the Devic…9.3
• CVE-2026-42364An os command injection vulnerability exists in the DdnsSett…8.8
• CVE-2026-42365A guessable session cookie vulnerability exists in the Web I…7.5