PT-2026-3232 · Apache · Apache Airflow

Ankit Chaurasia + 1 · Published 2026-01-15 · Updated 2026-02-20 · CVE-2025-68675

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6

Description Apache Airflow versions before 3.1.6 did not properly handle sensitive information within proxy URLs in Connection objects. Specifically, proxy credentials embedded in the proxies and proxy fields were not automatically masked in log output, potentially exposing them when connections were rendered or printed to logs.

Recommendations Upgrade to version 3.1.6 or later to resolve this issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2026-00598

BIT-AIRFLOW-2025-68675

CVE-2025-68675

GHSA-7C2F-R6GC-H92H

PYSEC-2026-10

Affected Products

Apache Airflow

References · 16

• https://github.com/apache/airflow/pull/59688 · Patch
• https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-68675 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00598 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68675 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7c2f-r6gc-h92h · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2025-68675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68675 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-10 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://twitter.com/oss_security/status/2011976009986265199 · Twitter Post
• https://twitter.com/CVEnew/status/2012126422253310411 · Twitter Post
• https://twitter.com/_cvereports/status/2012828317381009610 · Twitter Post
• http://openwall.com/lists/oss-security/2026/01/15/6 · Note
• https://twitter.com/ThreatSynop/status/2013641511942910076 · Twitter Post