CVE-2026-65017

{
  "id": "CVE-2026-65017",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T16:17:12.577",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking."
    },
    {
      "lang": "es",
      "value": "La API de Config de Apache Airflow no enmascaraba los valores de configuración sensibles con ámbito de equipo en despliegues multi-equipo. Cuando un administrador había habilitado el modo multi-equipo y expuesto la API de Config, un Visor autenticado con solo acceso de lectura de configuración - sin acceso previo al secreto - podía leer una URL de broker de Celery con ámbito de equipo, incluyendo sus credenciales incrustadas, en texto claro, mientras que la opción global equivalente estaba correctamente enmascarada. El enmascarador de secretos solo coincidía con los nombres de sección base y de opción y no normalizaba las secciones con prefijo de equipo antes de la comprobación de sensibilidad (CWE-200). Esto es un bypass de enmascarador distinto de CVE-2026-48828 y CVE-2026-48892: los despliegues que se actualizaron a apache-airflow 3.3.0 para abordar esos problemas siguen afectados por esta variante con ámbito de equipo. Se aconseja a los usuarios actualizar a apache-airflow 3.3.1 o posterior, que normaliza las secciones con ámbito de equipo antes del enmascaramiento."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.python.org",
          "packageName": "apache-airflow",
          "packageURL": "pkg:pypi/apache-airflow",
          "versions": [
            {
              "version": "3.3.0",
              "lessThan": "3.3.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T12:14:29.576426Z",
          "id": "CVE-2026-65017",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.3.0",
              "versionEndExcluding": "3.3.1",
              "matchCriteriaId": "F6D5F0B2-15A2-4782-8CC5-769E57D5F2F6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/70755",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48828",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48892",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    }
  ]
}