CVE-2026-54183

{
  "id": "CVE-2026-54183",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T16:17:04.640",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary.\n\nThis is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later."
    },
    {
      "lang": "es",
      "value": "El enmascarador de secretos de Apache Airflow oculta los valores almacenados bajo nombres de clave sensibles cuyo se muestran en la interfaz de usuario (UI). El límite de profundidad de recursión del enmascarador no descendía a valores anidados dentro de una lista, tupla o conjunto más allá de ese límite, por lo que una Variable de Airflow que contenía un valor tan profundamente anidado se mostraba sin enmascarar en la interfaz de usuario de Variables. La exposición se limita a la interfaz de usuario (UI): cualquier usuario autenticado que pueda ver la Variable en la interfaz de usuario ya puede leer su valor completo a través de la API REST de Variables, por lo que esto no revela datos que el usuario no pudiera obtener de otra manera - el enmascaramiento es una defensa contra la mirada por encima del hombro para la interfaz de usuario, no un límite de control de acceso.\n\nEsto es un seguimiento de corrección incompleta para CVE-2026-42358, cuya corrección solo hizo que el recorrido del diccionario fuera ilimitado; las listas, tuplas y conjuntos más allá del límite de profundidad permanecieron sin enmascarar en la interfaz de usuario. Las implementaciones que aplicaron la corrección de CVE-2026-42358 también deberían actualizarse para abordar este caso residual. Actualice a apache-airflow 3.3.1 o posterior."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.python.org",
          "packageName": "apache-airflow",
          "packageURL": "pkg:pypi/apache-airflow",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.3.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T16:42:41.368499Z",
          "id": "CVE-2026-54183",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.3.1",
              "matchCriteriaId": "FDF5E090-3549-452E-BB3A-741DCE15078E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/68422",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42358",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}