CVE-2026-65017

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65017", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-21T13:37:17.055Z", "datePublished": "2026-08-12T15:31:26.092Z", "dateUpdated": "2026-11-03T06:59:03.183Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.3.1", "status": "affected", "version": "3.3.0", "versionType": "semver"}], "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow-core"}], "credits": [{"lang": "en", "type": "finder", "value": "Andrew Rukin (Arenadata)"}, {"lang": "en", "type": "remediation developer", "value": "Jarek Potiuk"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking."}], "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:59:03.183Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/airflow/pull/70755"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-48828"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-48892"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)", "x_generator": {"engine": "airflow-s/generate_cve_json.py"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T12:14:29.576426Z", "id": "CVE-2026-65017", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T12:14:48.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-65017", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T12:14:29.576426Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T12:14:20.603Z"}}], "cna": {"title": "Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Andrew Rukin (Arenadata)"}, {"lang": "en", "type": "remediation developer", "value": "Jarek Potiuk"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.3.0", "lessThan": "3.3.1", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow-core", "packageName": "apache-airflow-core", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/70755", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38", "tags": ["vendor-advisory"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-48828", "tags": ["related"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-48892", "tags": ["related"]}], "x_generator": {"engine": "airflow-s/generate_cve_json.py"}, "descriptions": [{"lang": "en", "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.", "supportingMedia": [{"type": "text/html", "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:59:03.183Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65017", "state": "PUBLISHED", "dateUpdated": "2026-11-03T06:59:03.183Z", "dateReserved": "2026-07-21T13:37:17.055Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-12T15:31:26.092Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-core", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.3.1", "status": "affected", "version": "3.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6D5F0B2-15A2-4782-8CC5-769E57D5F2F6", "versionEndExcluding": "3.3.1", "versionStartIncluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking."}, {"lang": "es", "value": "La API de Config de Apache Airflow no enmascaraba los valores de configuraci\u00f3n sensibles con \u00e1mbito de equipo en despliegues multi-equipo. Cuando un administrador hab\u00eda habilitado el modo multi-equipo y expuesto la API de Config, un Visor autenticado con solo acceso de lectura de configuraci\u00f3n - sin acceso previo al secreto - pod\u00eda leer una URL de broker de Celery con \u00e1mbito de equipo, incluyendo sus credenciales incrustadas, en texto claro, mientras que la opci\u00f3n global equivalente estaba correctamente enmascarada. El enmascarador de secretos solo coincid\u00eda con los nombres de secci\u00f3n base y de opci\u00f3n y no normalizaba las secciones con prefijo de equipo antes de la comprobaci\u00f3n de sensibilidad (CWE-200). Esto es un bypass de enmascarador distinto de CVE-2026-48828 y CVE-2026-48892: los despliegues que se actualizaron a apache-airflow 3.3.0 para abordar esos problemas siguen afectados por esta variante con \u00e1mbito de equipo. Se aconseja a los usuarios actualizar a apache-airflow 3.3.1 o posterior, que normaliza las secciones con \u00e1mbito de equipo antes del enmascaramiento."}], "id": "CVE-2026-65017", "lastModified": "2026-11-03T07:20:56.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65017", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T12:14:29.576426Z", "version": "2.0.3"}}]}, "published": "2026-08-12T16:17:12.577", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/airflow/pull/70755"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38"}, {"source": "security@apache.org", "tags": ["Not Applicable"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-48828"}, {"source": "security@apache.org", "tags": ["Not Applicable"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-48892"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.3.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Airflow", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "airflow", "vendor": "apache"}], "created": "2026-08-12T20:30:03.833272+00:00", "updated": "2026-08-13T15:15:13.212802+00:00", "vendors": ["apache", "apache$PRODUCT$airflow"]}