Jarek Potiuk

Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag

Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext

Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation

Apache Airflow: Logout token revocation fails open; errors silently swallowed

Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization