Apache Airflow 3.4.0: Patch and Hardening Steps for the Secrets-Masker Gaps

Apache’s own security advisories, posted to the oss-security mailing list on 9 November 2026, describe five bugs in Apache Airflow. Three sit in the Apache Airflow secrets masker; two sit in its Dag-permission and XCom APIs.

Apache calls four of the five low or moderate in its own advisories. It rates the fifth, the apprise connection bug, as important, the highest severity word of the group. Apache Airflow 3.4.0, released 6 November 2026, fixes all five.

This is a different set of bugs from an older remote-code-execution flaw in Airflow’s MySQL provider. That one let an attacker run code; these five let an unintended reader see a secret or push past a permission check.

What Is the Apache Airflow Secrets Masker, and What Did It Miss?

Airflow’s secrets masker is the filter that turns a Connection password or a Variable value into asterisks before it reaches task logs, rendered templates or the API. Apache’s advisories describe three places where that filter let a secret through in cleartext.

• CVE-2026-113504 (moderate): the masker’s pattern matching stopped descending into nested data after five levels, so a secret buried deeper than that showed in cleartext in task logs and rendered templates. Zero Science Lab’s Gjoko Krstic found it.
• CVE-2026-111452 (low): the masker matched sensitive key names only in snake_case, so values stored under camelCase keys such as privateKey, connectionString or webhookUrl stayed unmasked. Researcher Anass Bali, known as 0xbaas, found it.
• CVE-2026-107474 (important): the connections API never masked the apprise notification provider’s “config” extra field. A user who could read connections saw those credentials in cleartext, even though Airflow 3 otherwise treats connection fields as write-only. The finder is credited as JelyFishhhhhh.

All three need a user who can already read task logs, rendered templates or connections. Apache’s own wording says this is a reader who is “not meant to see” that particular secret.

Two More Gaps in the Same Release

CVE-2026-111453 (low) sits in the API that deletes an asset’s queued events. It checked Dag-edit permission against the dag_id value in the query string, but deleted queued events for every Dag the caller could merely read.

Apache calls this an incomplete fix for an earlier flaw, CVE-2026-75157. A team that patched that flaw by upgrading to 3.3.2 stayed exposed to this variant. Narrowing who can read a Dag, not only who can edit it, follows the same least-privilege thinking behind Apache’s own fix.

CVE-2026-111421 skips the check that blocks certain reserved key names when a task writes an XCom value. A task-written value could later make the API server build classes from the airflow namespace, with attacker-chosen arguments, when someone viewed that XCom.

Apache’s own word for this one is moderate. NVD’s record instead carries a CISA-assigned score of 8.8, High, on CVSS 3.1; no CVSS 4.0 score sits in the record or NVD. CISA’s own entry in that record lists exploitation as none, and Apache calls this an incomplete fix for CVE-2026-59242.

The Patch and Hardening Checklist

Apache’s advisories all point to the same fix: upgrade to Apache Airflow 3.4.0 or later. The order below is ours, written for a team that cannot upgrade every environment today.

1. Find every Airflow buildCheck each environment’s version against 3.4.0, through the Admin, About page or the airflow version command.
2. Upgrade to 3.4.0 or laterApache’s advisories name this as the fix for all five gaps; follow your usual patch management process and restart the webserver, scheduler and workers.
3. Add the missed key namesUntil every environment is upgraded, add privateKey, connectionString, webhookUrl and accessKey to the sensitive_var_conn_names setting so the masker also catches those camelCase names.
4. Narrow what a task’s XCom can buildSet allowed_deserialization_classes to your own needed classes instead of the default airflow.*, which is the exact namespace CVE-2026-111421 abuses.
5. Tighten who reads logs and connectionsReview which roles can read task logs, rendered templates and connections; Apache’s own advisories name that read access as the one thing every masker gap needs.
6. Check what secrets may already be exposedSearch task logs and rendered templates for a secret shown in cleartext; if you find one, rotate it and follow our playbook for leaked credentials.

None of the five CVEs sit in the CISA Known Exploited Vulnerabilities catalogue, version 2026.11.06, the most recent version as of this writing. NVD lists all five records as Received, as of 9 November 2026.