CVE-2026-65017 Apache Software Foundation CVE debrief

Who should care

Airflow administrators, security teams, and teams responsible for configuring and maintaining Airflow deployments should assess exposure and prioritize remediation. These teams should verify if their Airflow deployment is using multi-team mode and has the Config API exposed, and take necessary steps to address the vulnerability.

Why it matters

CVE-2026-65017 is a sensitive information disclosure vulnerability in Apache Airflow's Config API that allows authenticated Viewers to read team-scoped sensitive configuration values in cleartext. Airflow administrators and security teams should verify exposure and prioritize upgrading to apache-airflow 3.3.1 or later.

• Authenticated Viewers with configuration-read access could read sensitive team-scoped configuration values.
• Team-scoped Celery broker URLs and embedded credentials could be exposed in cleartext.
• Verification of exposure and remediation is necessary for Airflow administrators and security teams.
• Upgrading to apache-airflow 3.3.1 or later is necessary to address this vulnerability.

Technical summary

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments, allowing an authenticated Viewer with configuration-read access to read a team-scoped Celery broker URL, including its embedded credentials, in cleartext. This issue arises from the API's failure to normalize team-prefixed sections before masking, leading to exposure of sensitive information. The vulnerability can be addressed by upgrading to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

Defensive priority

Airflow administrators and security teams should verify exposure and prioritize upgrading to apache-airflow 3.3.1 or later.

Recommended defensive actions

• Verify if your Airflow deployment is using multi-team mode and has the Config API exposed.
• Check if any authenticated Viewers have configuration-read access.
• Upgrade to apache-airflow 3.3.1 or later.
• Review team-scoped configuration values and ensure proper masking.
• Monitor for unauthorized access to sensitive configuration values.
• Perform a thorough review of Airflow deployments for exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, and Apache Airflow has released a patch in version 3.3.1. The vulnerability allows an authenticated Viewer with configuration-read access to read team-scoped sensitive configuration values in cleartext. The issue arises from the Config API's failure to normalize team-prefixed sections before masking. Evidence of this vulnerability includes the CVE record, NVD entry, and Apache Airflow's patch release.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.