The Config API in Apache Airflow surfaces per‑key secrets‑backend overrides as synthetic configuration options whose names are not flagged as sensitive, preventing the internal masker from redacting them. As a result, an authenticated user with Config read permission can obtain plaintext backend credentials such as Vault "secret_id". The vulnerability is classified as CWE‑200 and constitutes a confidentiality breach, exposing credentials that could be used to authenticate to the configured secrets backend or related services.

Apache Airflow installations that configure secrets back‑ends through per‑key environment variable overrides and run a version earlier than 3.3.0 are vulnerable. Deployments upgraded to apache‑airflow 3.3.0 or newer contain the remediation.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of < 1% suggests a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated UI/API user that has Config read permission. The likely attack vector is an authenticated API or UI call to the Config endpoint, as inferred from the need for Config read access. Once the credentials are obtained, they can be used to access the configured secrets backend, potentially allowing further credential compromise, but no additional privileges or zero‑day tools are required.