CVE-2025-54831
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-26

Last updated on: 2025-11-04

Assigner: Apache Software Foundation

Description
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option. This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior. Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-26
Last Modified
2025-11-04
Generated
2026-06-16
AI Q&A
2025-09-26
EPSS Evaluated
2026-06-14
NVD
CVE-2025-54831
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache airflow 3.0.3
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-213 The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

In Apache Airflow 3.0.3, a vulnerability exists where sensitive connection information, intended to be restricted to users with Connection Editing permissions, could be viewed by users with only READ permissions via both the API and UI. This violates the intended 'write-only' model for sensitive fields and bypasses the configuration meant to hide such data.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive connection information to users who should only have read access, potentially exposing credentials or other confidential data that should be protected.

Mitigation Strategies

Users of Airflow 3.0.3 should upgrade to Airflow version 3.0.4 or later to mitigate this vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-54831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart