Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

中 6.5CVE-2026-48828 · BIT-airflow-2026-48828 · GHSA-563f-2439-rmq4 · 07/07/2026 公開 · 25/10/2026 更新

要点

CVE-2026-48828 は apache-airflow, airflow (apache) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.66%（全脆弱性の 51.8% より高い）。
対処：3.3.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
apache-airflow PyPI	`< 3.3.0`	`3.3.0`
airflow apache	`< 3.3.0`	`3.3.0`

概要

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based should_hide_value_for_key check (which triggers on secret-suffixed key names like *_password / *_token / *_secret) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to apache-airflow 3.3.0 or later (the fix landed on main after 3.2.2; no 3.2.x backport).

NVD の説明

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport).