Apache Airflow writes variable values and connection ‘extra’ fields to the audit log in cleartext when they are submitted through bulk PATCH endpoints. Masking logic only applies to top‑level request fields, so nested data in bulk requests remains unmasked, exposing sensitive credentials such as passwords and tokens. Any authenticated user who can read audit logs, even without direct permission to view variables or connections, can retrieve these secrets. The vulnerability is classified as CWE‑532, an information disclosure through log records.

This issue affects installations of Apache Airflow from the Apache Software Foundation. No specific version range is supplied, but the fix is contained in Apache Airflow 3.3.1 and later. Deployments that upgraded only to the CVE‑2026‑50204 fix (which covers single‑entity endpoints) remain vulnerable.

The CVSS score of 6.5 indicates a medium severity vulnerability. The attack requires an authenticated user with audit‑log read privileges—a role typically privileged in a production environment. The EPSS score is < 1%, indicating a very low probability of exploitation in the current data set, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the exposure of encrypted credentials in an otherwise encrypted database can enable credential theft and lateral movement, especially in multi‑tenant deployments. Without the patch, attackers with legitimate log‑access permissions could retrieve and misuse secrets, constituting a significant threat to confidentiality.