Sensitive Information Exposure in Apache Airflow 3.0.3

CVE-2025-54831

What is CVE-2025-54831?

In Apache Airflow version 3.0.3, a change intended to limit access to sensitive connection fields was improperly implemented, allowing users with READ permissions to access sensitive connection information through both the API and the user interface. This unintended exposure overrides the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS configuration, compromising sensitive data security. Users of Airflow 3.0.3 should update to version 3.0.4 or later to mitigate this vulnerability, as Airflow 2.x does not experience this issue due to the intended behavior of sensitive field access.

References