CVE-2025-65995

MEDIUM EPSS 52.0%
Published Feb 21, 20264mo ago · Modified Feb 25, 20264mo ago
6.5 CVSS 3.1
Medium
Find Similar
Published Feb 21, 2026 4mo ago
Last Modified Feb 25, 2026 4mo ago

Description

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.  The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
52.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-209

Affected Products 2

VendorProductVersionRange
apacheairflow* <2.11.1
apacheairflow*≥3.0.0  –  <3.1.4

References 4

  • openwall.com http://www.openwall.com/lists/oss-security/2025/12/12/2
    Mailing ListThird Party Advisory
  • github.com https://github.com/apache/airflow/pull/58252
    Issue TrackingPatch
  • github.com https://github.com/apache/airflow/pull/61883
    Issue TrackingPatch
  • lists.apache.org https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2
    Mailing ListVendor Advisory

Remediation

  • github.com https://github.com/apache/airflow/pull/58252
    Issue TrackingPatch
  • github.com https://github.com/apache/airflow/pull/61883
    Issue TrackingPatch