CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

• CWE-200

• https://github.com/apache/airflow/pull/70755Issue Tracking, Patch
• https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38Mailing List, Vendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-48828Not Applicable
• https://www.cve.org/CVERecord?id=CVE-2026-48892Not Applicable

Published

Aug 12, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65011Graylog2 Server before commit 46a2eeb contains a missing per…5.3
• CVE-2026-65012InvokeAI before 6.13.7 contains an unauthenticated directory…6.3
• CVE-2026-65013Onlook through 0.2.32, fixed in commit 423e2e9, contains a b…8.8
• CVE-2026-65014n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) r…5.3
• CVE-2026-65015n8n versions before 2.30.1 contain a privilege escalation vu…8.8
• CVE-2026-65016n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a p…8.8
• CVE-2026-6504The Royal Elementor Addons and Templates plugin for WordPres…6.4
• CVE-2026-65048Ninja Forms plugin for WordPress versions 3.10.4 through 3.1…9.3
• CVE-2026-65049Ninja Forms plugin version 3.14.8 and prior for WordPress Mu…9.3
• CVE-2026-6505The ACAP framework contains a Time-of-Check to Time-of-Use (…5.1
• CVE-2026-65050Ninja Forms WordPress plugin version 3.14.8 and prior contai…7.1
• CVE-2026-65051Ninja Forms WordPress plugin version 3.14.8 contains a clien…6.9