PT-2025-51040 · Apache · Apache Airflow

Amogh Desai + 1 · Published 2025-12-12 · Updated 2025-12-16 · CVE-2025-66388

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.4

Description A flaw exists in Apache Airflow where authenticated users of the user interface could view secret values within rendered templates. This occurred because secrets were not properly redacted, potentially granting unauthorized access to sensitive information.

Recommendations Upgrade to version 3.1.4 to resolve this issue.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BIT-AIRFLOW-2025-66388

CVE-2025-66388

GHSA-FV47-PQH6-WXGQ

PYSEC-2025-86

Affected Products

Apache Airflow

References · 15

• https://github.com/apache/airflow/pull/58772 · Patch
• https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fv47-pqh6-wxgq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2025-66388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66388 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66388 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/pull/58767 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2025-86.yaml · Note
• https://twitter.com/oss_security/status/1999575343770865699 · Twitter Post
• https://t.me/CVEtracker/39823 · Telegram Post
• http://openwall.com/lists/oss-security/2025/12/12/1 · Note
• https://twitter.com/CVEnew/status/2000611210014896187 · Twitter Post
• https://t.me/cveNotify/145758 · Telegram Post