{"items":[{"id":"NVI-00013013","kind":"vulnerability","title":"Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-g4qj-5vxv-wggf","CVE-2026-54183"],"plain_summary":"GitHub lists this reviewed advisory for apache-airflow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-141177ee0e67fe312d9fb00bb597fa37"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-02T23:13:29.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-397a8c5e2d0e9c7f6d2d2b4db49fb12f"},{"kind":"CVSS","as_of":"2026-11-03T07:20:55.513Z","value":"4.3 MEDIUM (3.1)","meaning":"134c704f-9b21-4f2e-91b3-4a467353bcc0 severity; no combined Null risk score.","source_id":"sr-141177ee0e67fe312d9fb00bb597fa37"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-397a8c5e2d0e9c7f6d2d2b4db49fb12f","url":"https://github.com/advisories/GHSA-g4qj-5vxv-wggf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g4qj-5vxv-wggf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:39:10.636Z"},{"id":"sr-141177ee0e67fe312d9fb00bb597fa37","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54183","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-54183","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T22:35:50.402Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-397a8c5e2d0e9c7f6d2d2b4db49fb12f"],"technology":"apache-airflow","known_exclusions":[],"conditions_summary":"Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary.\n\nThis is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.","public_affected_ranges":["< 3.3.1"]}],"null_published_at":"2026-11-04T10:04:35.911Z","source_updated_at":"2026-10-02T23:13:29.000Z","source_disclosed_at":"2026-08-12T18:31:18.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T01:39:10.636Z"},{"id":"NVI-00013013","kind":"vulnerability","title":"Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g4qj-5vxv-wggf","CVE-2026-54183"],"plain_summary":"GitHub lists this reviewed advisory for apache-airflow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-397a8c5e2d0e9c7f6d2d2b4db49fb12f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-02T23:13:29.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-397a8c5e2d0e9c7f6d2d2b4db49fb12f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-397a8c5e2d0e9c7f6d2d2b4db49fb12f","url":"https://github.com/advisories/GHSA-g4qj-5vxv-wggf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g4qj-5vxv-wggf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:39:10.636Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-397a8c5e2d0e9c7f6d2d2b4db49fb12f"],"technology":"apache-airflow","known_exclusions":[],"conditions_summary":"Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary.\n\nThis is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.","public_affected_ranges":["< 3.3.1"]}],"null_published_at":"2026-11-01T07:29:12.908Z","source_updated_at":"2026-10-02T23:13:29.000Z","source_disclosed_at":"2026-08-12T18:31:18.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:39:10.636Z"}],"next_cursor":null,"snapshot_revision":"42594"}