A bug in the Apache Airflow Variable response masker allows an authenticated UI/API user with Variable read permission to view nested secret values in cleartext when the JSON depth exceeds the masker's recursion limit. The vulnerability occurs because the masker returns the original nested item before checking whether the key name is sensitive. The key‑name bypass pattern that was partially fixed for a shallower nesting depth in the prior CVE now reappears beyond the recursion cap, enabling disclosure of protected data stored under keys like "password", "token", or "secret". The flaw is a CWE-200 vulnerability, exposing confidential information; the impact is limited to confidentiality loss with no code execution or state modification possible.

Apache Airflow deployments that use the Variable UI/API to store sensitive values in deeply nested JSON structures are affected. Versions prior to Apache Airflow 3.2.2—including those that were patched for CVE-2026-32690 but have not been upgraded to cover this depth‑limit bypass—remain vulnerable.

Based on the description, it is inferred that the attack vector is internal. The CVSS score is 6.5, and the EPSS score is < 1%, but the lack of anonymous exploitation and the need for read permissions suggest a moderate risk of secret disclosure. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at the time of publication. However, any entity that has exposed sensitive information via deeply nested Variables could experience a significant confidentiality breach if an attacker gains or already possesses Variable read access.