CVE-2025-68438

The record

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display. Users are recommended to upgrade to 3.1.6 or later, which fixes this issue

Affected packages

Related vulnerabilities

• GHSA-8r55-rv5w-6pfm Apache Airflow exposes sensitive information in its log files Also affects apache-airflow
• GHSA-r837-hpv7-pc2f Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate… Also affects apache-airflow
• CVE-2024-56373 DAG Author (who already has quite a lot of permissions) could manipulate database of… Also affects apache-airflow
• CVE-2025-27555 Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with… Also affects apache-airflow
• GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs Also affects apache-airflow
• CVE-2025-65995 When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the… Also affects apache-airflow
• GHSA-5g2w-9f8g-g5q7 Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users Also affects apache-airflow
• CVE-2026-24098 Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI… Also affects apache-airflow