The Bulk Variables API in Apache Airflow incorrectly calls the redactor function without supplying the variable key. This disables the key‑based should_hide_value_for_key check that normally hides secrets whose names end with secret‑suffixes such as *_password, *_token, or *_secret. As a result, an authenticated user with permission to read variables in bulk can retrieve plaintext values stored inside JSON‑typed Airflow Variables that would otherwise be redacted. This is a confidentiality threat described by CWE‑200.

All Apache Airflow installations that rely on bulk variable operations and store sensitive information in JSON‑type variables with secret‑suffixed keys are vulnerable. The flaw exists in every release up to 3.2.2; the fix is incorporated in the main branch after 3.2.2 and appears in version 3.3.0 and later.

The CVSS score of 6.5 reflects the impact of credential disclosure, while the EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Airflow user with bulk variable read permissions, which can be exercised via the web UI or the REST API. The risk remains high for environments that store secrets in JSON variables under secret‑suffix patterns.