CVE-2025-66388
Medium · 6.5Apache Airflow exposes secret values to authenticated UI users via rendered templates
CVSS
6.5
EPSS
0.5%
Published
Dec 15, 2025
CISA due date
—
The record
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | apache-airflow | 3.1.0 | 3.1.5 |
| Bitnami | airflow | 3.1.0 | 3.1.4 |
| pypi | apache-airflow | 3.1.0 | No fix |
Related vulnerabilities
- GHSA-fv47-pqh6-wxgq Apache Airflow exposes secret values to authenticated UI users via rendered templates Same vulnerability
- GHSA-8r55-rv5w-6pfm Apache Airflow exposes sensitive information in its log files Also affects apache-airflow
- GHSA-r837-hpv7-pc2f Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate… Also affects apache-airflow
- CVE-2024-56373 DAG Author (who already has quite a lot of permissions) could manipulate database of… Also affects apache-airflow
- CVE-2025-27555 Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with… Also affects apache-airflow
- GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs Also affects apache-airflow
- CVE-2025-65995 When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the… Also affects apache-airflow
- GHSA-5g2w-9f8g-g5q7 Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users Also affects apache-airflow