Unauthorized Access to Sensitive Data in Apache Airflow

CVE-2025-66388

What is CVE-2025-66388?

A vulnerability in Apache Airflow allows authenticated users of the UI to access and view sensitive secret values that are not properly redacted in rendered templates. This flaw can potentially expose confidential information to users who lack the necessary authorization to access such data. It is highly recommended that users upgrade to version 3.1.4, which addresses and resolves this vulnerability, ensuring improved security and proper access controls.

References