VULNERABILITY INTELLIGENCE

CVE-2026-65017

CVSS score6.5 MEDIUM

EPSS probability0.23%

CISA KEVNot currently listed

Published2026-08-12

Last modified2026-10-24

Description

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could rea…