CVE-2025-68438

CWE-200 — Information Exposure5 documents5 sources
Severity
7.5HIGH
EPSS
0.0%
top 94.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedJan 16

Description

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display. Users are recommended to upgrade to 3.1.6 or later, which fixes this issue

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/airflow3.1.0 — 3.1.6
▶PyPIapache-airflow3.1.0 — 3.1.6

🔴Vulnerability Details

3
CVEList
Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated↗2026-01-16
▶
OSV
Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated↗2026-01-16
▶
GHSA
Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated↗2026-01-16
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-68438 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-68438 (HIGH CVSS 7.5) | In Apache Airflow versions before 3 | cvebase.io