PT-2026-33058 · Airflow · Airflow

Saurabh Banawar · CVE-2026-25219 · Published 2026-04-15 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.1.8

Description The secrets masker failed to mark the access key and connection string connection properties as sensitive. This allows users with read permissions to view these values in the Connection UI. Additionally, if a Connection is accidentally recorded in logs, these values are exposed. Azure Service Bus uses these properties to store sensitive data, and other providers using the same fields may also be affected.

Recommendations Upgrade to version 3.1.8.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-AIRFLOW-2026-25219

CVE-2026-25219

ECHO-0AA9-B91A-8EF7

GHSA-4G48-54Q2-FG7Q

PYSEC-2026-2344

Affected Products

Airflow

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25219.json · Exploit
• https://github.com/apache/airflow/pull/61580 · Patch
• https://github.com/apache/airflow/pull/61582 · Patch
• https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25219 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2344 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4g48-54q2-fg7q · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-25219 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25219 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://twitter.com/VulmonFeeds/status/2044451572789268523 · Twitter Post
• https://twitter.com/CVEnew/status/2044737981047550023 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/15/3 · Note
• https://pypi.org/project/apache-airflow · Note
• https://pypi.python.org · Note