Apache Airflow exposes secrets backend credentials through the Config API

中 6.5CVE-2026-48892 · BIT-airflow-2026-48892 · GHSA-9933-5rrp-mfwx · 07/07/2026 公開 · 25/10/2026 更新

要点

CVE-2026-48892 は apache-airflow, airflow (apache) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.66%（全脆弱性の 51.7% より高い）。
対処：3.3.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
apache-airflow PyPI	`< 3.3.0`	`3.3.0`
airflow apache	`< 3.3.0`	`3.3.0`

概要

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID and AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID) as synthetic config options whose option names were not in sensitive_config_values, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault role_id / secret_id, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to apache-airflow 3.3.0 or later.

NVD の説明

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.