Apache Airflow’s audit logging flaw caused Connection and Variable secret values to be stored in cleartext within the Log.extra column because the secrets masker matched only on configured key names. An authenticated user with low‑privilege read access to the audit API could retrieve those rows and recover the credentials verbatim, exposing sensitive authentication data to unauthorized parties (CWE-312).

This issue affects all releases of Apache Airflow prior to version 3.4.0. It applies to installations that use the default audit logging configuration and contain Connections or Variables storing secret values.

The vulnerability is exploitable by any user that can read the audit log, a privilege that is often granted to users with minimal permissions. No specific network attack is required, and the EPSS score is not available, but the absence of a KEV listing suggests no documented active exploitation yet. Nonetheless, the impact of credential exposure warrants urgent remediation.