Apache Airflow’s Task SDK fails to mask the contents of a Variable whose JSON value is a list. Masking logic only applied to strings or dictionaries, leaving top‑level lists exposed. As a result, any secrets stored in list‑shaped Variables appear in cleartext in task logs and the Rendered Templates UI. Anyone with authenticated access to these logs or the UI can read the secret values without needing additional configuration.

This flaw impacts Apache Software Foundation’s Apache Airflow deployments that are running a version prior to 3.3.1 and have not applied the patch that addressed the dict case in CVE‑2026‑59244. Users who upgraded to versions that included the fixed dict masking are still affected if they store secrets in list‑shaped Variables, because the list handling was not covered by the earlier fix.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available, so the current likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated user who can access task logs or the Rendered Templates UI; no special configuration or elevated privileges are needed. Once exploited, the attacker can obtain confidential secrets stored as list‑shaped Variables, compromising confidentiality.