PT-2026-3231 · Apache · Apache Airflow

Amogh Desai + 1 · Published 2026-01-15 · Updated 2026-01-21 · CVE-2025-68438

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6

Description When rendered template fields in a Dag exceed max templated field length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This is due to the serialization of these fields using a secrets masker instance that did not include user-registered mask secret() patterns, resulting in unreliable masking of secrets before truncation and display.

Recommendations Upgrade to version 3.1.6 or later to resolve this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-00683

BIT-AIRFLOW-2025-68438

CVE-2025-68438

GHSA-3QMM-R55X-HPXX

Affected Products

Apache Airflow

References · 12

• https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00683 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68438 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qmm-r55x-hpxx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68438 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2025-68438 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://twitter.com/VulmonFeeds/status/2012155993132523771 · Twitter Post
• http://openwall.com/lists/oss-security/2026/01/15/5 · Note
• https://twitter.com/oss_security/status/2011976009986265199 · Twitter Post
• https://twitter.com/ThreatSynop/status/2013641511942910076 · Twitter Post
• https://twitter.com/CVEnew/status/2012126424426033152 · Twitter Post