Apache Airflow's secrets masker is designed to hide sensitive values stored under certain keys when displayed in the UI. However, the recursion-depth limit in the masker did not descend properly into values nested inside lists, tuples, or sets beyond the limit, causing deeply nested sensitive values to be shown unmasked in the Variables UI. This vulnerability is a residual issue following the partial fix for CVE-2026-42358, which only addressed dictionary traversal. The exposure is limited to the UI and does not expand the access rights of authenticated users, serving primarily as a shoulder-surfing defense. The issue affects Apache Airflow versions before 3.3.1, which includes deployments that applied the previous fix but did not upgrade further.

Sensitive information stored in deeply nested data structures within Airflow Variables may be exposed in the UI to any authenticated user with access to the Variables page. Since these users can already retrieve the full values via the Variables REST API, the impact is limited to UI exposure and does not increase data access privileges. This vulnerability primarily weakens the UI masking protection against casual observation (shoulder surfing) but does not constitute an access control bypass or data leak to unauthorized users.

Upgrade Apache Airflow to version 3.3.1 or later, which addresses this residual masking issue. Deployments that applied the fix for CVE-2026-42358 should also upgrade to 3.3.1 or newer to fully resolve the problem. No other mitigation is required as the exposure does not grant additional access beyond existing authenticated user permissions.