The Config API in Apache Airflow versions before 3.3.0 exposes plaintext secrets-backend credentials due to missing redaction of synthetic config options derived from per-key environment variable overrides. Specifically, environment variables like AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID and AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID are surfaced as config options but their names are not included in the sensitive_config_values list used by the masker. Consequently, an authenticated UI or API user with Config read permission can access sensitive Vault credentials such as role_id and secret_id in plaintext. This vulnerability affects deployments that configure secrets backends using these per-key environment overrides. The issue is resolved by upgrading to Apache Airflow version 3.3.0 or later.

An authenticated user with Config read permission can obtain plaintext secrets-backend credentials, including Vault role_id and secret_id, from the Config API output. This exposure of sensitive information could lead to unauthorized access to secrets managed by the backend, potentially compromising the confidentiality of sensitive data managed by Airflow deployments using per-key environment overrides for secrets backends.

Upgrade Apache Airflow to version 3.3.0 or later, where this issue is fixed. There is no indication of an official patch or temporary fix other than upgrading. Deployments should avoid using affected versions to prevent exposure of secrets-backend credentials. Patch status is confirmed by the vendor advisory recommending upgrade to 3.3.0 or later.