PUBLISHED
2025-12-15 12:15
MODIFIED
2025-12-15 12:15
EPSS (Prob. Exploit)
0.48%
Top 58.7%
> DESCRIPTION
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.
Users are recommended to upgrade to version 3.1.4, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-201: Insertion of Sensitive Information Into Sent Data - The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
> GITHUB SECURITY ADVISORY
GHSA-fv47-pqh6-wxgq
MODERATE
Apache Airflow exposes secret values to authenticated UI users via rendered templates
AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.1.0, < 3.1.4
Fixed in: 3.1.5
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI
ALIASES:
BIT-airflow-2025-66388, GHSA-fv47-pqh6-wxgq, PYSEC-2025-86
> HISTORIQUE DES MODIFICATIONS
Première apparition
15/12/2025 12:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:38
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/01/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-201: Insertion of Sensitive Information Into Sent Data - The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that ac...
Total des modifications: 2
Dernière mise à jour: 9 months ago