CVE-2026-49487: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-49487 is a sensitive information exposure vulnerability in Apache Airflow affecting all versions before 3.3.0. The REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs (keyword arguments) without masking, allowing any authenticated user with DAG-scoped task-instance read access to read secrets — such as provider API keys or tokens — in clear text while the task was in a deferred state. The vulnerability was disclosed on July 7, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In Apache Airflow's deferrable operator model, when a task is deferred, the operator passes a trigger object along with keyword arguments (kwargs) that may include credentials such as API keys or tokens. The TriggerResponse.kwargs field in the REST API serialized and returned these decrypted kwargs verbatim as a stringified Python dict, without any masking or redaction. An authenticated attacker with low-privilege DAG-scoped task-instance read access could query the /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances or task-instance detail endpoints while a task was deferred to retrieve these secrets in plaintext. The fix, implemented in PR #67868, retains the kwargs field in the response schema for backwards compatibility but always returns it as an empty "{}" string, and marks the field as deprecated in the OpenAPI spec (GitHub PR, Openwall OSS-Sec).

Successful exploitation results in a high confidentiality impact: any authenticated Airflow user with DAG-scoped task-instance read access can harvest provider API keys, tokens, or other secrets passed by deferred operators to their triggers. There is no integrity or availability impact. Exposed credentials could be leveraged for lateral movement into third-party systems (e.g., cloud providers, databases, or external APIs) that the Airflow DAG interacts with, significantly expanding the blast radius beyond the Airflow instance itself (Github Advisory, Openwall OSS-Sec).

1. Reconnaissance: Identify an Apache Airflow instance running a version prior to 3.3.0 with deferrable operators in use (e.g., operators that use await / defer() with a trigger that accepts credentials as kwargs).
2. Authenticate: Obtain valid Airflow credentials for an account with at least DAG-scoped task-instance read access for a target DAG — this could be a low-privilege user account.
3. Identify deferred tasks: Monitor or query the REST API task-instance list endpoint (GET /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances) to identify tasks in the deferred state.
4. Extract secrets: While the task is in the deferred state, query the task-instance detail endpoint or list endpoint and inspect the trigger.kwargs field in the JSON response. The field returns the decrypted trigger keyword arguments as a stringified Python dict, potentially containing API keys, tokens, or other credentials.
5. Leverage credentials: Use the extracted secrets to authenticate against the targeted external service (e.g., a cloud provider API, database, or third-party platform) for further access or data exfiltration (GitHub PR, Openwall OSS-Sec).

• Network: Unusual or repeated REST API requests to Airflow task-instance endpoints (/api/v2/dags/.../taskInstances) from accounts that do not normally query these endpoints programmatically, particularly targeting tasks in deferred state.
• Logs: Airflow API access logs showing authenticated GET requests to task-instance detail or list endpoints with responses containing non-empty trigger.kwargs fields; access from unexpected IP addresses or at unusual times.
• Behavioral: Low-privilege user accounts making frequent or automated queries to task-instance endpoints across multiple DAGs; subsequent use of provider credentials (API keys, tokens) from IP addresses not associated with the Airflow triggerer process.

The primary remediation is to upgrade Apache Airflow to version 3.3.0 or later, which ensures the trigger.kwargs field in REST API responses is always returned as an empty "{}" string and is marked deprecated in the OpenAPI schema (Openwall OSS-Sec, GitHub PR). As an interim workaround prior to upgrading, restrict DAG-scoped task-instance read access to only users who strictly require it, minimizing the number of accounts that could exploit this exposure. Additionally, rotate any provider API keys, tokens, or other secrets that may have been passed as trigger kwargs in deferred operators on affected Airflow versions, and review API access logs for unauthorized queries to task-instance endpoints.

The vulnerability was discovered by Andrew Rukin of Arenadata and remediated by Jarek Potiuk (@potiuk) of the Apache Airflow project (Openwall OSS-Sec). The fix was discussed in the GitHub PR, where reviewer @ashb suggested removing the kwargs field entirely from the API response for security reasons; the final implementation retained the field as an empty string for backwards API compatibility while marking it deprecated. The vulnerability was noted on social platforms including Bluesky and tracked by multiple vulnerability databases shortly after disclosure.