Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands. A user who can read audit events but is denied...
CVE-2026-86468: Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/588
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
"Malicious" public disclosure is a lot better than other ways of misusing 0-days (Was: [oss-security] Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-p
Posted by Aaron Rainbolt on Nov 09 I mean, if someone with knowledge of a 0-day decides to act maliciously, I'd much rather them do so by making said 0-day public than…
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
Posted by theknell on Nov 09 Brian — Yours is the first reply that argues with the finding instead of the disclosure, so it gets an answer. "If you can access the config…
Re: [musl] Re: [oss-security] "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Rich Felker on Nov 09 I didn't see you'd also asked this on-list, so copying my answer here: This will possibly be changed (to always return null for failure)…
Re: “sshole”: password authentication bypass: OpenSSH + musl libc
Posted by Vidya Murthy on Nov 09 Adding a data point from the medical-device side: we reproduced this independently at Medcrypt, including on a stock Yocto image, no…
CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's secrets masker stopped descending into…
CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow before 3.4.0 Description: The Apache Airflow connections API did not mask the…