Apache Airflow has a vulnerability (CVE-2026-42360) involving the exposure of sensitive information due to improper masking of nested sensitive keys in rendered JSON template fields. When the rendered field length exceeds the max_templated_field_length setting, Airflow converts the JSON structure to a string before applying redaction, which causes nested sensitive keys to be missed and their plaintext values to be persisted in rendered_fields. Authenticated users with read access to rendered template fields can retrieve these secrets. This vulnerability is related to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is a variant of a previously fixed issue (CVE-2025-68438) that did not cover nested keys. Users who upgraded for CVE-2025-68438 must also upgrade to Apache Airflow 3.2.2 or later to address this nested key masking bypass.

The vulnerability allows authenticated users with permission to read rendered template fields in Apache Airflow to access sensitive information such as passwords, tokens, secrets, or API keys that should have been masked. This exposure occurs when nested sensitive keys inside JSON templates are not properly redacted due to the rendered field length exceeding a configured threshold. The impact is unauthorized disclosure of secrets within Airflow deployments that use structured JSON with nested sensitive keys.

Users should upgrade Apache Airflow to version 3.2.2 or later to fully address this vulnerability. This upgrade complements the previous fix for CVE-2025-68438 by covering nested sensitive-key masking. No other mitigation or temporary workaround is indicated in the available data. Patch status is not explicitly confirmed in vendor advisories, so users should verify the upgrade guidance with official Apache Airflow release notes.