Sensitive Data Exposure in Apache Airflow by The Apache Software Foundation

CVE-2025-68438

What is CVE-2025-68438?

In earlier versions of Apache Airflow, rendered templates may inadvertently expose sensitive data in plain text due to insufficient masking mechanisms. When template fields exceed the specified limit, the serialization process fails to adequately secure sensitive information, leading to its potential display in the Rendered Templates UI. This is attributed to the use of a secrets masker that does not encompass all user-defined masking patterns, resulting in a lack of reliable protection before data display. Users are advised to update to version 3.1.6 or later to mitigate this risk.

References