CVE-2026-86468

Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API. Users of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

• CWE-532

• https://github.com/apache/airflow/pull/72650
• https://lists.apache.org/thread.html/yl4dlhvstlnc1qogcw3n4bx216cjsmoo
• https://www.cve.org/CVERecord?id=CVE-2026-50204

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86462Apache Airflow FAB provider: changing a user's password thro…9.1
• CVE-2026-86463Apache CXF's FIQL query parser has a vulnerability in how it…7.5
• CVE-2026-86464In the current development version of Eclipse aeriOS, for wh…9.9
• CVE-2026-86465Apache Airflow Akeyless provider: the Akeyless secrets backe…6.5
• CVE-2026-86466Apache Airflow FAB provider: the Authentik OAuth path in the…8.1
• CVE-2026-86467Apache Airflow Amazon provider: the AWS auth manager's SAML …8.8
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8
• CVE-2026-86471An unvalidated runtime configuration value in Apache CouchDB…9.3
• CVE-2026-86472fast-uri is a dependency-free RFC 3986 URI parser for Node.j…4.8
• CVE-2026-86473Apache Airflow: the Core API logout endpoint revokes only a …9.1
• CVE-2026-86474The lack of TLS certificate validation when downloading firm…7.7