Apache Airflow versions before 3.2.2 contain a vulnerability where nested sensitive keys inside JSON template structures are not properly masked if the rendered template field exceeds the '[core] max_templated_field_length' setting. The system stringifies the structure before redaction, losing the context of nested keys and resulting in plaintext sensitive data being stored in 'rendered_fields'. An authenticated user with read access to rendered template fields can retrieve these secret values. This vulnerability is a variant of CWE-200 and related to a prior fix for user-registered mask_secret() patterns (CVE-2025-68438) that did not cover nested sensitive keys. The fix is included starting in Apache Airflow 3.2.2.

Sensitive information such as passwords, tokens, secrets, and API keys nested within JSON templates may be exposed in plaintext to authenticated users with permission to read rendered template fields. This could lead to unauthorized disclosure of credentials or secrets, potentially compromising confidentiality. The vulnerability does not affect integrity or availability. Exploitation requires authenticated access with specific permissions.

Upgrade Apache Airflow to version 3.2.2 or later. This version includes fixes that properly mask nested sensitive keys in rendered template fields, preventing exposure of plaintext secrets. Users who have already upgraded for CVE-2025-68438 should still apply this update to cover nested key paths. No other specific mitigations are indicated.