Jarek Potiuk

Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag

Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode

Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext

Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs

Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext

Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation