CVE-2025-66388 — Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI

CVE-2025-66388

Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI PUBLISHED

Description (CNA)

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Airflow	affected 3.1.0 before 3.1.4

CWE

CWE-201

References

https://github.com/apache/airflow/pull/58772
https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/12/12/1

CISA-ADP

No English description supplied.

No references supplied.