CVE-2026-48892

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.

• CWE-200

• https://github.com/apache/airflow/pull/67622Issue Tracking
• https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hkVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/07/07/4Third Party Advisory

Published

Jul 7, 2026

Last Modified

Jul 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48883Unauthenticated Broken Access Control in WPC Product Bundles…7.5
• CVE-2026-48885Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2…7.1
• CVE-2026-48886Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versi…9.3
• CVE-2026-48887Unauthenticated Broken Access Control in JS Help Desk <= 3.0…6.5
• CVE-2026-48889Subscriber Privilege Escalation in Amelia <= 2.3 versions.8.8
• CVE-2026-48891A bug in Apache Airflow's `/ui/dependencies` scheduling grap…4.3
• CVE-2026-48895URL Redirection to Untrusted Site ('Open Redirect') vulnerab…7.2
• CVE-2026-48896Insufficient state checks lead to a vector that allows to by…7.5
• CVE-2026-48897Insufficient state checks lead to a vector that allows to by…7.5
• CVE-2026-48898An improper access check allows privilege escalation through…9.8
• CVE-2026-48899An improper access check allows privilege escalation through…9.8
• CVE-2026-4890A Denial of Service (DoS) vulnerability in the DNSSEC valida…7.5