VulnSocial

CVE-2026-65017Disclosure(apache / airflow)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • airflow

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
apache
Products
airflow

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-08-12: 2Technical Details · 2026-08-12: 208-12
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-65017 Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and e… https://www.cve.org/CVERecord?id=CVE-2026-65017 ----- Traducción: CVE-2026-65017 El … http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-65017, indicating that Apache Airflow's Config API exposes sensitive team‑scoped values when multi‑team mode is enabled, but it does not provide any PoC, exploit, active usage, or patch information.

    0000035
    97 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-65017 Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and e… https://www.cve.org/CVERecord?id=CVE-2026-65017

    Post summary

    The post announces a new CVE (CVE‑2026‑65017) describing a security flaw in Apache Airflow’s Config API that could expose sensitive team‑scoped configuration values in multi‑team deployments, marking it as a disclosure of a vulnerability.

    000001.3K
    57.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheairflow---

Explore more

Back to dashboardapache CVEsairflow vulnerabilities