GitHub Advisoryadvisory · PyPI

GHSA-fv47-pqh6-wxgq Apache Airflow exposes secret values to authenticated UI users via rendered templates

MEDIUM Published 2025-12-15 Modified 2026-06-05 Official page ↗
Aliases
CVE-2025-66388
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-201
Reviewed
2025-12-16

Affected packages

• PyPI apache-airflow: >= 3.1.0, < 3.1.5 → fixed in 3.1.5

Description

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2025-66388 A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being… vulnerability

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References