Medium severity · published Dec 15, 2025
CVE-2025-66388
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing…
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.
Users are recommended to upgrade to version 3.1.4, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Airflow · Apache
3.1.0 before 3.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66388
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66388
Issue Tracking
https://github.com/apache/airflow/pull/58772
Mailing List
https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g
Mailing List
http://www.openwall.com/lists/oss-security/2025/12/12/1
More from Airflow
9.8
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
8.8
CVE-2020-11978
Apache Airflow Command Injection
9.8
CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
9.8
CVE-2023-25754
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0
9.8
CVE-2023-22884
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache…