Description
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this issue.
Affected products
apache: airflow
References3
- lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g Mailing ListVendor Advisory
- github.com/apache/airflow/pull/58772 Issue Tracking
- www.openwall.com/lists/oss-security/2025/12/12/1 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 42 · as of 11 November 2026
- CWE
- CWE-201
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.