Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2025-65995
PUBLISHED
More InfoOfficial Page
Assigner-apache
Assigner Org ID-f0158376-9dc2-43b6-827c-5f631a4d8d09
View Known Exploited Vulnerability (KEV) details
Published At-21 Feb, 2026 | 02:14
Updated At-21 Feb, 2026 | 02:57
Rejected At-
▼CVE Numbering Authority (CNA)
Apache Airflow: Disclosure of secrets to UI via kwargs

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.  The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

Affected Products
Vendor
The Apache Software FoundationApache Software Foundation
Product
Apache Airflow
Collection URL
https://pypi.python.org
Package Name
apache-airflow
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 3.1.4 (semver)
  • From 0 before 2.11.1 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-209CWE-209 Generation of Error Message Containing Sensitive Information
Type: CWE
CWE ID: CWE-209
Description: CWE-209 Generation of Error Message Containing Sensitive Information
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Textual description of severity
text:
moderate
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Frieder Gottman (Cariad)
reporter
Jens Scheffler (Bosch)
remediation developer
Jens Scheffler (Bosch)
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/apache/airflow/pull/58252
patch
https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2
vendor-advisory
https://github.com/apache/airflow/pull/61883
patch
Hyperlink: https://github.com/apache/airflow/pull/58252
Resource:
patch
Hyperlink: https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2
Resource:
vendor-advisory
Hyperlink: https://github.com/apache/airflow/pull/61883
Resource:
patch
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://www.openwall.com/lists/oss-security/2025/12/12/2
N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/12/12/2
Resource: N/A
Details not found