Bug 2569027 (CVE-2026-86468)
| Summary: | CVE-2026-86468 apache-airflow: apache-airflow: Information disclosure via improper secret masking in command-line audit logs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability-draft | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Apache Airflow. The command-line interface (CLI) records command arguments in audit logs but masks sensitive values based on positional argument placement rather than content. As a result, certain command structures leave sensitive data, such as passwords and connection parameters, stored in plain text. An authenticated user with read access to audit logs can retrieve these exposed credentials through the event-log application programming interface (API), bypassing access controls on sensitive resources.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-09 10:01:54 UTC
|