The updated description confirms that the access_key and connection_string fields were not marked as sensitive names in Airflow’s secrets masker, allowing users with read permission to view these values in the Connection UI or in logs where connections are inadvertently written. The exposed data includes credentials used by Azure Service Bus and potentially other providers employing the same fields, resulting in a confidentiality compromise (CWE-200).

Apache Airflow, specifically any deployment that uses Azure Service Bus connections with access_key or connection_string properties. Other providers that store sensitive data in the same fields may also be impacted. No specific version information is provided in the CNA data.

This is a confidentiality-only risk that requires read access to the Connection UI or logs, with no privilege escalation. The CVSS score is 6.5, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, which together suggest a moderate likelihood of exploitation. Mitigation is required promptly to prevent accidental leakage of credentials. The attack vector is an authorized user with view permissions reading the UI or parsing logs.