An Airflow JSON Variable edit can overwrite a masked secret

Masking should prevent a password from being displayed, but it must not turn the mask into the stored value. An Airflow 3.2.2 issue reports that editing a JSON Variable in the UI can serialize a masked secret as literal asterisks. A routine configuration change then becomes an outage risk.

Identify mixed-purpose Variables

Inventory JSON Variables that contain both operational settings and credentials. Treat a masked field as unknown during UI edits; do not infer that the original value will be preserved when the form is saved. Check the installed version and reproduce on a disposable credential.

Move credentials to a suitable backend

Keep ordinary runtime configuration separate from secrets. Airflow documents secrets backends for connections and variables, with different UI visibility and lookup precedence. Design the migration and rotation with those semantics in mind, rather than copying secret values through a shared ticket or log.

Verify the read path after a change

Use a controlled integration check that can authenticate without printing the secret. Confirm which backend supplies the value after deployment, especially if both metastore and an external backend contain the same key. Revert promptly if the consumer fails.

Adovo’s view

A redacted form field is a display choice, not a safe write contract. Credentials should have a narrow update path and a functional readback check. Separate them from ordinary JSON edits before the next routine change tests the boundary for you.