CVE-2026-42360

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the nested-key path.

• CWE-200

• https://github.com/apache/airflow/pull/65906Issue Tracking, Patch
• https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4Mailing List, Vendor Advisory

Published

Jun 1, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42354Sentry is an error tracking and performance monitoring tool.…9.8
• CVE-2026-42355NanaZip is an open source file archive. From 5.0.1252.0 to b…5.5
• CVE-2026-42357Incorrect Authorization vulnerability allows users to access…6.5
• CVE-2026-42358A bug in Apache Airflow's Variable response masker caused ne…6.5
• CVE-2026-42359A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2…8.8
• CVE-2026-4236A security vulnerability has been detected in itsourcecode O…7.3
• CVE-2026-42363An insufficient encryption vulnerability exists in the Devic…9.3
• CVE-2026-42364An os command injection vulnerability exists in the DdnsSett…8.8
• CVE-2026-42365A guessable session cookie vulnerability exists in the Web I…7.5
• CVE-2026-42366Multiple reflected cross-site scripting (xss) vulnerabilitie…6.1
• CVE-2026-42367A privilege escalation vulnerability exists in the Web Inter…6.5
• CVE-2026-42368A privilege escalation vulnerability exists in the Web Inter…9.9