Apache Airflow is an open-source platform for developing, scheduling, and monitoring workflows, such as traditional time based or event-triggered batch-oriented data pipelines, machine learning, model training, and agentic or LLM-based workloads. Airflow’s extensible Python framework enables you to build workflows connecting with virtually any technology, with a growing set of providers for orchestrating AI and agentic tools alongside the rest of your pipeline. A web-based UI helps you visualize, manage, and debug your workflows. You can run Airflow in a variety of configurations - from a single process on your laptop to a distributed system capable of handling massive workloads.
Apache Airflow suffers from a sensitive information disclosure vulnerability caused by an incomplete secret-masking routine. In the secrets masker, container structures are walked without a depth limit for key-name redaction, but pattern-based masking of registered secrets is applied only to string values at or below a fixed recursion depth (MAX_RECURSION_DEPTH): beyond that depth the scalar is returned as-is, before the secret-replacement step runs. As a result, a configured secret that appears as a string value nested under non-sensitive keys several container levels deep is not redacted and is emitted in clear text to task logs. An operator, or anyone with log access, can recover credentials that were expected to be masked.