CVE-2025-65995CWE-209

Apache Airflow: Disclosure of secrets to UI via kwargs

Medium · published February 21, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.

The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00888 · 58.9th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-02-21T02:14Z
EPSS history
Timeline
  • 21 FEB 02:14Z
    Apache Airflow: Disclosure of secrets to UI via kwargs
    cvelistv5