GitHub Advisoryadvisory · PyPI

GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs

MEDIUM Published 2026-02-21 Modified 2026-02-25 Official page ↗
Aliases
CVE-2025-65995
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2026-02-25

Affected packages

• PyPI apache-airflow: < 2.11.1 → fixed in 2.11.1 • PyPI apache-airflow: >= 3.0.0b1, < 3.1.5rc1 → fixed in 3.1.5rc1

Description

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.  The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

Related

Alias · CVE (1)

  • CVE-2025-65995 When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References