Apache Airflow Nested Variable Secret Redaction Bypass Vulnerability

A vulnerability exists in Apache Airflow versions 3.0.0 prior to 3.2.0, where secrets in variables saved as JSON dictionaries were not properly redacted. When these variables were retrieved by the user, secrets stored in nested fields were not masked. This issue affects users who store sensitive values in JSON format. The vulnerability has been addressed in Apache Airflow 3.2.0.

Impact

Exploitation of this vulnerability could lead to unintended disclosure of sensitive information, as secrets in nested JSON variables were not properly redacted when the variables were accessed.

Remediation

Users are advised to upgrade to Apache Airflow version 3.2.0, which includes the necessary fix. Instructions for upgrading can be found in the Apache Airflow documentation.