A flaw in Apache Airflow 3.x allows secrets stored as JSON dictionaries within Variables to bypass the redaction mechanism when the variable is retrieved, exposing nested secret values. The vulnerability stems from the redaction logic limiting its depth to a single level, leaving deeper layers unmasked. This can lead to sensitive credentials being disclosed to any user or process that fetches the variable, undermining confidentiality safeguards.

Apache Airflow versions 3.x before 3.2.0 are impacted when variables contain nested secret values in JSON form. Airflow installations that do not store sensitive data this way are not affected. No specific patch level is listed in the CNA data beyond the note that upgrading to 3.2.0 removes the issue.

The vulnerability, classified under CWE-668, has a low confidentiality risk as reflected by its CVSS score of 3.7. Its EPSS score is less than 1%, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. The attack vector likely involves a maliciously or inadvertently privileged user retrieving variables via the Airflow UI or REST API; no network or privilege escalation is required beyond that access level.