lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Apache Airflow

Apache Software FoundationCI/CD4 credentials

Credentials4 documented
01

Fernet Key

apache-airflow / fernet-key

Airflow encrypts sensitive connection and variable values at rest with a fernet key. A leaked fernet key plus metadata DB access can decrypt stored connection passwords and variable values.

generated on installsecretsecret value

Looks like

example
example

Fernet key shape commonly used by Airflow for encrypted metastore secrets

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

Location

environment
AIRFLOW__CORE__FERNET_KEY
config file
~/airflow/airflow.cfg, /opt/airflow/airflow.cfg

Airflow default/home and container configuration files

config file
airflow.cfg

Project-local Airflow configuration file

secret store

Kubernetes Secrets, Helm secrets, cloud secret managers, and Airflow secrets backends

source code

Committed airflow.cfg, deployment manifests, and test configs

logs

Startup logs and support bundles

02

Webserver Secret Key

apache-airflow / webserver-secret-key

Airflow webserver uses a secret key for signing web sessions and CSRF state.

generated on installsecretsecret value

Location

environment
AIRFLOW__WEBSERVER__SECRET_KEY, AIRFLOW__API_AUTH__JWT_SECRET

Airflow config environment variables for webserver signing and API JWT secret where applicable

config file
~/airflow/airflow.cfg, /opt/airflow/airflow.cfg, ~/airflow/webserver_config.py, /opt/airflow/webserver_config.py

Airflow webserver/API secret-key configuration files

config file
airflow.cfg, webserver_config.py

Project-local Airflow webserver config files

secret store

Kubernetes Secrets, Helm secrets, and cloud secret managers

source code

Committed configs and deployment manifests

03

Connection / Variable Secret

apache-airflow / connection-secret

Airflow stores credentials for external systems as Connections and Variables in the metastore, exact AIRFLOW_CONN/AIRFLOW_VAR environment variables, or configured secrets backends.

user definedsecretsecret value

Location

database

Airflow metadata database storing encrypted connection and variable values

config file
~/airflow/airflow.cfg, /opt/airflow/airflow.cfg

Airflow configuration and secrets backend settings

config file
airflow.cfg

Project-local Airflow configuration

secret store

HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, Kubernetes Secrets, environment variables, and custom backends

source code

DAG repositories, tests, committed connection URIs, variables, and examples

logs

Task logs, connection debugging, scheduler output, and webserver traces

Notes

Airflow supports arbitrary AIRFLOW_CONN_<CONN_ID> and AIRFLOW_VAR_<KEY> names; those are intentionally not listed as wildcard environment locations.

04

Web UI User Password

apache-airflow / admin-user-password

Airflow web UI users authenticate through the configured auth manager or webserver auth backend. Local user credentials are deployment-specific and often provisioned by CLI, containers, Helm, or secrets backends.

user definedsecretusername/password

Location

environment
AIRFLOW_WWW_USER_USERNAME, AIRFLOW_WWW_USER_PASSWORD

Airflow container/init examples commonly use these exact bootstrap variables

database

Airflow metadata database user tables for local auth configurations

public interface
/login, /api/

Airflow webserver UI and API login contexts

secret store

Helm secrets, Kubernetes Secrets, password vaults, and identity-provider secrets

source code

Docker Compose files, Helm values, local development configs, and deployment automation

logs

Setup output and authentication traces

Notes

There is no universal Airflow administrator password.

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.