CVE-2026-48828

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).

• CWE-200

• https://github.com/apache/airflow/pull/67495Issue Tracking, Patch
• https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847ycVendor Advisory, Mailing List
• http://www.openwall.com/lists/oss-security/2026/07/07/2Third Party Advisory, Mailing List

Published

Jul 7, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48820CakePHP is a rapid development framework for PHP. In version…6.3
• CVE-2026-48821Shaarli is a personal bookmarking service. Versions 0.16.1 a…5.8
• CVE-2026-48822Shaarli is a personal bookmarking service. Versions 0.16.1 a…5.8
• CVE-2026-48823Shaarli is a personal bookmarking service. Versions 0.16.1 a…4.8
• CVE-2026-48824Mailpit is an email testing tool and API for developers. Pri…5.3
• CVE-2026-48827Path traversal vulnerability in Apache MINA SSHD bundle sshd…7.1
• CVE-2026-48829In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dere…7.5
• CVE-2026-4883The Piotnet Forms plugin for WordPress is vulnerable to arbi…9.8
• CVE-2026-48831Wine ships a .desktop file that registers itself as a MIME h…7.3
• CVE-2026-48832action/cookie.php in ecrire in SPIP before 4.4.15 is prone t…3.5
• CVE-2026-48834Improper Handling of Length Parameter Inconsistency vulnerab…7.5
• CVE-2026-48835Unauthenticated Broken Access Control in Contact Form by WPF…7.5