CVE-2025-66388

CWE-2015 documents5 sources
Severity
6.5MEDIUM
EPSS
0.0%
top 88.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedDec 15

Description

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/airflow3.1.0 — 3.1.4
▶PyPIapache-airflow3.1.0 — 3.1.5

🔴Vulnerability Details

3
GHSA
Apache Airflow exposes secret values to authenticated UI users via rendered templates↗2025-12-15
▶
OSV
Apache Airflow exposes secret values to authenticated UI users via rendered templates↗2025-12-15
▶
CVEList
Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI↗2025-12-15
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-66388 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-66388 (MEDIUM CVSS 6.5) | A vulnerability in Apache Airflow a | cvebase.io