CVE-2025-66388CWE-201

CVE-2025-66388

Medium · published December 15, 2025

CVSS v3.1

6.5

EPSS

Percentile

40.4

In the wild

Unconfirmed

What it is

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.

Users are recommended to upgrade to version 3.1.4, which fixes this issue.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00479 · 40.4th percentile
Weakness: CWE-201 · Insertion of Sensitive Information Into Sent Data
Published: 2025-12-15T17:15Z

Affected products (1)

Product	Versions	Fixed in
apache/airflow	≥ 3.1.0, < 3.1.4	3.1.4

References (3)

https://github.com/apache/airflow/pull/58772 · [email protected]https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g · [email protected]http://www.openwall.com/lists/oss-security/2025/12/12/1 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

15 DEC 11:30Z
Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI
cvelistv5