Apache AirflowGHSA-gfw7-2v73-69wg
Apache Airflow error reporting may expose full kwargs
Medium6.5CVE-2025-65995 · Published Feb 21, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.11.1 | 2.11.1 |
| >= 3.0.0b1, < 3.1.5rc1 | 3.1.5rc1 |
Details and references
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-209
- Also known as
- BIT-airflow-2025-65995, CVE-2025-65995, PYSEC-2026-2348
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 24 | Apache Airflow exposes sensitive information in its log files CVE-2025-27555Medium6.5fixed in 2.11.1 | Medium6.5 | 2.11.1 |
| Feb 24 | Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table CVE-2024-56373High8.4fixed in 2.11.1 | High8.4 | 2.11.1 |
| Feb 9 | Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users CVE-2026-24098Medium6.5fixed in 3.1.7 | Medium6.5 | 3.1.7 |
| Feb 9 | Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access CVE-2026-22922Medium6.5fixed in 3.1.7 | Medium6.5 | 3.1.7 |
| Mar 17 | Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata CVE-2026-26929High7.5fixed in 3.1.8 | High7.5 | 3.1.8 |
| Mar 17 | Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications CVE-2026-28779High7.5fixed in 3.1.8 | High7.5 | 3.1.8 |