EUVD-2025-209413
GHSA-j86x-fwp2-qh7v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Reading task logs or crossing role boundaries requires an authenticated low-privilege account, so PR:L rather than the vendor's PR:N; impact is confidentiality-only secret disclosure, hence I:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.0.0.
DescriptionCVE.org
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though Airflow's intentions and security model of Airflow did not suggest different assumptions. The overall security model [1], workload isolation [2], and JWT authentication details [3] are now described in more detail. Users concerned with role isolation and following the Airflow security model of Airflow are advised to upgrade to Airflow 3.2, where several security improvements have been implemented. They should also read and follow the relevant documents to make sure that their deployment is secure enough. It also clarifies that the Deployment Manager is ultimately responsible for securing your Airflow deployment. This had also been communicated via Airflow 3.2.0 Blog announcement [4].
[1] Security Model: https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html [2] Workload isolation: https://airflow.apache.org/docs/apache-airflow/stable/security/workload.html [3] JWT Token authentication: https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html [4] Airflow 3.2.0 Blog announcement: https://airflow.apache.org/blog/airflow-3.2.0/
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
AnalysisAI
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented workload-isolation and JWT-authentication assumptions, allowing sensitive credentials to surface in task logs and role boundaries to be weaker than a Deployment Manager might assume. The fix in 3.2.0 hardens the secrets masker (PR #58662) and formalizes the security model, JWT token authentication, and workload isolation guidance. No public exploit is identified and EPSS is very low (0.04%), making this a hardening/hygiene issue rather than an urgent exploited flaw.
Technical ContextAI
Apache Airflow is a Python-based workflow orchestration platform whose executors run user-authored DAG task code and stream execution logs to operators and task authors. The classified root cause is CWE-532 (insertion of sensitive information into log files): the task-SDK secrets masker (task-sdk/src/airflow/sdk/execution_time/secrets_masker.py) is responsible for redacting connection passwords, Variables, and other secrets before they are written to logs, and the 3.2.0 change reworks its deprecated-import compatibility path and the mask_secret entry point. The broader advisory also concerns JWT-based inter-component authentication and workload isolation between the API server, scheduler, triggerer, and worker tasks, where previously implicit trust assumptions could let a task or role observe data outside its intended boundary.
RemediationAI
Vendor-released patch: upgrade to Apache Airflow 3.2.0, which fixes the secrets-masking behavior and ships the clarified security guidance. Because much of this CVE is about deployment posture, also read and apply the referenced documentation - the Airflow security model, workload isolation (https://airflow.apache.org/docs/apache-airflow/stable/security/workload.html), and JWT token authentication (https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html) - plus the 3.2.0 release blog (https://airflow.apache.org/blog/airflow-3.2.0/). If you cannot upgrade immediately, restrict who can view task logs and access the UI/API to trusted operators, store connections and Variables in a secrets backend rather than plaintext env/config, and avoid printing secrets in DAG code or operator output (trade-off: reduces debugging visibility); enforce component-to-component JWT authentication and network segmentation between worker, scheduler, and API server (trade-off: added deployment complexity). The Deployment Manager remains ultimately responsible for securing the deployment.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today