CVE-2025-65995

MEDIUM6.5EPSS 0.02%

Apache Airflow: Disclosure of secrets to UI via kwargs

Published: 2/21/2026Modified: 2/25/2026

Also known as:GHSA-gfw7-2v73-69wgBIT-airflow-2025-65995

Description

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

Affected packages (2)

Bitnami/airflowfrom 0, < 2.11.1, >= 3.0.0, < 3.1.4
PyPI/apache-airflowfrom 0, < 2.11.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-65995
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/pull/58252
WEBhttps://github.com/apache/airflow/pull/61883
WEBhttps://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2
WEBhttp://www.openwall.com/lists/oss-security/2025/12/12/2