CVE-2025-66236
Insufficient Deployment Security Assumptions in Apache Airflow Before
Publication date: 2026-04-13
Last updated on: 2026-04-17
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | airflow | From 3.0.0 (inc) to 3.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-66236 is a vulnerability in Apache Airflow related to improper masking of secrets when using a deprecated import path for the mask_secret() function.
The deprecated import path redirected the mask_secret() function to a single-process implementation that only masked secrets within the task subprocess. However, the supervisor process, which writes the logs, did not receive the masking instructions, causing secrets to remain visible in the task logs.
This means that sensitive information could be exposed in logs despite attempts to mask it.
The issue was fixed by redirecting mask_secret() to a supervisor-aware implementation that masks secrets both in the task subprocess and the supervisor process, preventing secret leakage in logs.
How can this vulnerability impact me? :
This vulnerability can lead to exposure of sensitive information in Airflow task logs.
If secrets are not properly masked, unauthorized users who have access to logs could see confidential data such as passwords, tokens, or other secrets.
This exposure increases the risk of data breaches, unauthorized access, and potential compromise of systems relying on those secrets.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper masking of secrets in Apache Airflow logs when using a deprecated import path for the mask_secret() function. Detection involves checking if your Airflow deployment uses the deprecated import path `airflow.sdk.execution_time.secrets_masker` for secret masking.
One practical way to detect this issue is to review your Airflow task logs for unmasked sensitive information that should have been masked.
Additionally, you can inspect your DAG code or Python scripts for imports from the deprecated path by running a command like:
- grep -r "airflow.sdk.execution_time.secrets_masker" /path/to/your/airflow/dags
If this import is found, your deployment is likely affected by the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate mitigation is to upgrade your Apache Airflow deployment to version 3.2.0 or later, where this issue has been fixed.
If upgrading immediately is not possible, review your DAGs and code to remove any usage of the deprecated import path `airflow.sdk.execution_time.secrets_masker` and instead use the supported import path `airflow.sdk.log` for the mask_secret() function.
Also, carefully review your Airflow deployment security model and workload isolation settings as described in the official Airflow documentation to ensure your deployment is secure.
Finally, monitor your logs for any exposure of secrets and avoid using deprecated APIs that could lead to secret leakage.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability relates to the improper masking of secrets in Apache Airflow logs, which could lead to exposure of sensitive information. Such exposure can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and proper handling of secrets.
The CVE description emphasizes that secure Airflow deployments require the Deployment Manager to take appropriate security actions and follow the security model of Airflow. Upgrading to Airflow 3.2.0 is recommended as it includes several security improvements that help ensure secrets are properly masked and workload isolation is enforced.
Failure to mask secrets properly in logs could lead to unauthorized disclosure of sensitive data, which may violate data protection requirements under regulations such as GDPR and HIPAA. Therefore, addressing this vulnerability by upgrading and following the security guidelines is important for maintaining compliance.