CVE-2025-27555

CWE-532 — Log File Information ExposureCWE-2015 documents5 sources
Severity
6.5MEDIUM
EPSS
0.0%
top 91.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedFeb 24

Description

Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. Users w…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/airflow< 2.11.1
▶PyPIapache-airflow< 2.11.1

🔴Vulnerability Details

3
GHSA
Apache Airflow exposes sensitive information in its log files↗2026-02-24
▶
CVEList
Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli↗2026-02-24
▶
OSV
Apache Airflow exposes sensitive information in its log files↗2026-02-24
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-27555 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-27555 (MEDIUM CVSS 6.5) | Airflow versions before 2.11.1 have | cvebase.io