PT-2025-39520 · Apache · Apache Airflow

Published 2025-09-25 · Updated 2025-10-06 · CVE-2025-54831

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.0.0 through 3.0.3

Description A change in Apache Airflow 3 introduced a "write-only" model for sensitive connection information, intended to restrict access to Connection Editing Users. However, in version 3.0.3, this model was unintentionally bypassed, allowing users with READ permissions to view sensitive connection details through the API and the UI. This behavior also disregarded the AIRFLOW CORE HIDE SENSITIVE VAR CONN FIELDS configuration option. The issue does not affect Airflow 2.x. The sensitive information exposed includes connection passwords.

Recommendations Upgrade Apache Airflow to version 3.0.4 or later.

Fix

Weakness Enumeration

CWE-213

Related Identifiers

BDU:2025-12604

BIT-AIRFLOW-2025-54831

CVE-2025-54831

GHSA-Q475-2PGM-7HVP

PYSEC-2025-85

Affected Products

Apache Airflow

References · 19

• https://osv.dev/vulnerability/GHSA-q475-2pgm-7hvp · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-85 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12604 · Security Note
• https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54831 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2025-54831 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://reddit.com/r/TechNadu/comments/1nrvkve/apache_airflow_303_vulnerability_cve202554831 · Reddit Post
• https://twitter.com/rewterz/status/1972925055308013855 · Twitter Post
• https://t.me/pentestingnews/68727 · Telegram Post
• https://twitter.com/TechNadu/status/1971932402411880851 · Twitter Post
• https://twitter.com/CVEnew/status/1971539555435065439 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1971844232399794534 · Twitter Post
• http://openwall.com/lists/oss-security/2025/09/25/4 · Note