Skip to content

Fix Akeyless JWT connection credential is not redacted#67443

Merged
gopidesupavan merged 1 commit into
apache:mainfrom
gopidesupavan:fix-akeyless-jwt-exposure-issue
May 25, 2026
Merged

Fix Akeyless JWT connection credential is not redacted#67443
gopidesupavan merged 1 commit into
apache:mainfrom
gopidesupavan:fix-akeyless-jwt-exposure-issue

Conversation

@gopidesupavan
Copy link
Copy Markdown
Member

Why

Airflow's default secrets redaction does not treat a bare jwt extra key as sensitive. Akeyless JWT credentials stored in connection extra can therefore be returned unmasked via the API and UI, exposing reusable authentication credentials to users who can read connections.

What

Rename the Akeyless connection extra key from jwt to jwt_token in provider metadata and generated provider info so it matches Airflow's default sensitive-key substrings and is redacted by default.
providers/akeyless/provider.yaml


Was generative AI tooling used to co-author this PR?
  • Yes (please specify the tool below)

  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

@eladkal
Copy link
Copy Markdown
Contributor

eladkal commented May 25, 2026

cc @baraka-akeyless

@gopidesupavan gopidesupavan merged commit 41ec009 into apache:main May 25, 2026
91 checks passed
@gopidesupavan gopidesupavan deleted the fix-akeyless-jwt-exposure-issue branch May 25, 2026 08:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants