CVE-2026-49487 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Airflow deployments should assess exposure and prioritize upgrading to Apache Airflow 3.3.0 or later to prevent sensitive information disclosure.

Why it matters

CVE-2026-49487 is a medium-severity vulnerability in Apache Airflow before 3.3.0, where the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking, potentially exposing sensitive information. Defenders and administrators of Apache Airflow deployments should assess exposure and prioritize upgrading to Apache Airflow 3.3.0 or later to prevent sensitive information disclosure.

• Potential exposure of sensitive information such as provider API keys
• Need for verification of current Airflow version and inventory of affected deployments
• Priority for upgrading to Apache Airflow 3.3.0 or later to prevent sensitive information disclosure
• Potential impact on confidentiality due to clear text exposure of sensitive values

Technical summary

In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred. This vulnerability can lead to potential exposure of sensitive information such as provider API keys. Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API. The vulnerability has a CVSS score of 6.5 and a CVSS severity of MEDIUM.

Defensive priority

Upgrade to Apache Airflow 3.3.0 or later to prevent sensitive information disclosure.

Recommended defensive actions

• Upgrade to Apache Airflow 3.3.0 or later
• Review and adjust access controls for DAG-scoped task-instance read access
• Monitor API usage for sensitive information exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Apache Airflow before 3.3.0, where the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking, potentially exposing sensitive information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.