The secrets masker in Apache Airflow hides values that are stored under sensitive key names when they are displayed in the UI. However, the masker's recursion‑depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply nested value was shown unmasked in the Variables UI. Because any authenticated user can already read the full value through the Variables REST API, the vulnerability does not expose data that could not otherwise be obtained; it only removes a shoulder‑surfing protection in the UI. This limited breach of confidentiality is reflected in the CWE‑200 classification.

The affected product is Apache Airflow from the Apache Software Foundation. All releases of Airflow before version 3.3.1 that included the prior CVE‑2026‑42358 fix are impacted by this residual case. Deployments that applied the earlier patch should also upgrade to Airflow 3.3.1 or later to eliminate the unmasked nested values.

The CVSS score of 4.3 indicates a moderate risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that automated exploitation is currently not widespread. The likely attack vector is through the Variables UI by an authenticated user, but because the same information can already be retrieved via the REST API, the overall threat impact remains limited. In practice, the risk is considered moderate but lower than typical remote code execution or wider data disclosure scenarios.