CVE-2025-66388
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-16
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | airflow | From 3.1.0 (inc) to 3.1.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache Airflow allowed authenticated users of the UI to see secret values in rendered templates because the secrets were not properly redacted. This means sensitive information could be exposed to users who should not have access to it. The issue was fixed in version 3.1.4 by improving the redaction of secrets in the UI rendering process. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive secret values to authenticated users who do not have the proper authorization. This exposure of secrets could compromise security by revealing credentials or other confidential information, potentially leading to further attacks or data breaches. [1]
What immediate steps should I take to mitigate this vulnerability?
Upgrade Apache Airflow to version 3.1.4 or later, as this version includes the fix that properly redacts secrets in rendered templates and prevents their exposure in the UI. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA. However, since the vulnerability allows authenticated users to view secret values that should be concealed, it could potentially lead to unauthorized exposure of sensitive information, which may affect compliance with data protection regulations that require safeguarding sensitive data. No direct statements about compliance impact are given. [1, 3]