https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:10:03.252082+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2026-48892 BIT-airflow-2026-48892 — Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options 2026-10-03T23:10:03.256711+00:00

Affected: Bitnami: airflow

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.

 https://cve.radiocsirt.org/vuln/euvd-2026-369563 EUVD-2026-369563 2026-10-03T23:10:03.256794+00:00 EUVD-2026-369563 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48892 fkie_cve-2026-48892 2026-10-03T23:10:03.256819+00:00

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.

 https://cve.radiocsirt.org/vuln/ghsa-9933-5rrp-mfwx GHSA-9933-5rrp-mfwx — Apache Airflow exposes secrets backend credentials through the Config API 2026-10-03T23:10:03.256857+00:00

Affected: PyPI: apache-airflow

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.

 https://cve.radiocsirt.org/vuln/pysec-2026-2087 PYSEC-2026-2087 2026-10-03T23:10:03.256893+00:00

Affected: PyPI: apache-airflow

The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2223 WID-SEC-W-2026-2223 — Apache Airflow: Mehrere Schwachstellen 2026-10-03T23:10:03.256926+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.