PT-2025-51039 · Apache · Airflow

Frieder Gottman + 1 · Published 2025-12-12 · Updated 2026-02-24 · CVE-2025-65995

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.1.4 Airflow versions prior to 2.11.1

Description A flaw exists in Airflow where the user interface (UI) error reporting could expose sensitive information passed as keyword arguments (kwargs) to operators when a Directed Acyclic Graph (DAG) failed during parsing. This exposure was limited to authenticated users with permission to view the affected DAG. The issue could lead to the disclosure of secrets or other sensitive values included within the kwargs.

Recommendations Upgrade to Airflow version 3.1.4 or later. Upgrade to Airflow version 2.11.1 or later.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BIT-AIRFLOW-2025-65995

CVE-2025-65995

GHSA-GFW7-2V73-69WG

Affected Products

Airflow

References · 13

• https://github.com/apache/airflow/pull/61883 · Patch
• https://github.com/apache/airflow/pull/58252 · Patch
• https://osv.dev/vulnerability/GHSA-gfw7-2v73-69wg · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2025-65995 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65995 · Vendor Advisory
• https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65995 · Security Note
• https://github.com/apache/airflow · Note
• https://t.me/CVEtracker/45339 · Telegram Post
• http://openwall.com/lists/oss-security/2025/12/12/2 · Note
• https://twitter.com/CVEnew/status/2025154200246587593 · Twitter Post
• https://t.me/cveNotify/152690 · Telegram Post
• https://twitter.com/oss_security/status/1999575343770865699 · Twitter Post