Sensitive Data Exposure in Apache Airflow Products by Vendor Apache

CVE-2026-25219

What is CVE-2026-25219?

The Apache Airflow configuration regarding connection properties for services like Azure Service Bus lacks appropriate sensitivity markers. As a result, sensitive information such as access keys and connection strings can be inadvertently disclosed to users with read permissions. This exposure can occur in both the Connection UI and system logs, allowing unauthorized visibility of confidential data. Organizations are urged to update their Airflow installations to version 3.1.8 or later to safeguard sensitive information stored in connection properties.

References