In Apache Airflow versions before 3.3.0, the REST API task‑instance detail and list endpoints returned the trigger kwargs of deferred tasks without masking. When a deferred operator included a secret, such as an API key, as part of its trigger arguments, any authenticated user who had DAG‑scoped task‑instance read permission could retrieve that secret in clear text while the task remained deferred. This constitutes an information‑disclosure flaw under CWE‑200.

All installations of Apache Airflow running any version earlier than 3.3.0 are vulnerable, regardless of operating system or distribution. The vulnerability is tied to the task‑instance REST endpoints and can affect any DAG for which a user has read access.

The flaw requires an attacker to be an authenticated user with DAG‑scoped task‑instance read permission, so exposure is limited to the Airflow API. The CVSS score of 6.5 classifies it as moderate severity, and the EPSS score of <1% indicates a low but non‑zero likelihood of exploitation. It is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is inbound HTTP API requests, and exploitation is straightforward for users who already have legitimate access to the targeted DAG.