CVE Feed

    Dashboard / CVE / CVE-2025-66388

    CVE-2025-66388

    A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this issue.

    Published:Dec 15, 2025
    Last Modified:Dec 16, 2025
    EPS:Dec 15, 2025
    EPSS Score:0.00032
    CVSS Score:4.3

    Affected Products

    Vendor
    Apache
    Product
    Airflow

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-59244 (CVSS 6.5) — Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered …
    CVE-2026-58076 (CVSS 8.8) — Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam…
    CVE-2026-59242 (CVSS 5.4) — Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal …
    CVE-2026-54183 (CVSS 4.3) — Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U…
    CVE-2026-67260 (CVSS 7.3) — Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe…
    CVE-2026-67587 (CVSS 8.8) — Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic…
    CVE-2026-65017 (CVSS 6.5) — Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.…
    CVE-2026-68968 (CVSS 7.5) — Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf…
    CVE-2026-68969 (CVSS 6.5) — Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w…
    CVE-2026-68970 (CVSS 6.5) — Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High