Advisoriesby IbisApache AirflowGHSA-fv47-pqh6-wxgq
Apache Airflow exposes secret values to authenticated UI users via rendered templates
Fix: upgrade to 3.1.5 or later
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.
Users are recommended to upgrade to version 3.1.4, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 3.1.0, < 3.1.5 | 3.1.5 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-201
- Also known as
- BIT-airflow-2025-66388, CVE-2025-66388, PYSEC-2025-86
- nvd.nist.gov/vuln/detail/CVE-2025-66388
- github.com/apache/airflow/pull/58767
- github.com/apache/airflow/pull/58772
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2025-86.yaml
- lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g
- www.openwall.com/lists/oss-security/2025/12/12/1
More Apache Airflow advisories
All Apache Airflow
Apache Airflow proxy credentials for various providers might leak in task logsCVE-2025-68675fixed in 2.11.1 +1Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncatedCVE-2025-68438fixed in 3.1.6Edge3 Worker RPC RCE on Airflow 2CVE-2025-67895fixed in 2.0.0Apache Airflow `/api/v2/dagReports` executes DAG Python in APICVE-2025-62402fixed in 3.1.1Apache Airflow's create action can upsert existing Pools/Connections/VariablesCVE-2025-62503fixed in 3.1.1Apache Airflow has a command injection vulnerability in "example_dag_decorator"CVE-2025-54941fixed in 3.0.5