PT-2026-33058 · Airflow · Airflow

Saurabh Banawar · Published 2026-04-15 · Updated 2026-04-18 · CVE-2026-25219

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.1.8

Description The secrets masker failed to mark the access key and connection string connection properties as sensitive. This allows users with read permissions to view these values in the Connection UI. Additionally, if a Connection is accidentally recorded in logs, these values are exposed. Azure Service Bus uses these properties to store sensitive data, and other providers using the same fields may also be affected.

Recommendations Upgrade to version 3.1.8.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-AIRFLOW-2026-25219

CVE-2026-25219

GHSA-4G48-54Q2-FG7Q

Affected Products

Airflow

References · 11

• https://github.com/apache/airflow/pull/61580 · Patch
• https://github.com/apache/airflow/pull/61582 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2026-25219 · Vendor Advisory
• https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25219 · Security Note
• https://osv.dev/vulnerability/GHSA-4g48-54q2-fg7q · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://twitter.com/oss_security/status/2044454208707928315 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044451572789268523 · Twitter Post
• https://twitter.com/CVEnew/status/2044737981047550023 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/15/3 · Note