Advisoriesby IbisApache AirflowGHSA-gfw7-2v73-69wg
Apache Airflow error reporting may expose full kwargs
Fix: upgrade to 2.11.1 or later (2 fixed versions below)
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.
The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.11.1 | 2.11.1 |
| >= 3.0.0b1, < 3.1.5rc1 | 3.1.5rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-209
- Also known as
- BIT-airflow-2025-65995, CVE-2025-65995, PYSEC-2026-2348
More Apache Airflow advisories
All Apache Airflow
Apache Airflow: DAG authorization bypassCVE-2026-28563fixed in 3.1.8Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataCVE-2026-26929fixed in 3.1.8Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate tableCVE-2024-56373fixed in 2.11.1Apache Airflow exposes sensitive information in its log filesCVE-2025-27555fixed in 2.11.1Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated UsersCVE-2026-24098fixed in 3.1.7Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log AccessCVE-2026-22922fixed in 3.1.7