Apache Airflow's secrets masker failed to mask values stored in a Var.json Variable that are of dictionary type. The code checks only for string instances, so when a secret is stored as a JSON object and the template references var.json, the dictionary is revealed in the Rendered Templates UI. This allows any user who can view the rendered templates to read sensitive data in cleartext, leading to information disclosure, a weakness identified as CWE-312.

Affected deployments are Apache Airflow installations running any version prior to 3.3.1. The product is released by the Apache Software Foundation and version 3.3.1 and newer include a patch that masks nested Variable values regardless of type.

No CVSS or EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable by users who have access to the rendered templates view, which is often granted to analysts or developers. Because the data is exposed in the UI and no authentication bypass is required, the practical risk is high in environments where users with wide permissions exist. No public exploits have been reported yet, but the lack of mitigation information suggests that insiders or compromised accounts could abuse it.