Apache Airflow CVE-2025-66388

Exploitation requires an authenticated Airflow UI account (PR:L) that can access the Rendered Templates / rendered task-instance fields view but lacks authorization for the underlying secrets. The concrete prerequisite is that sensitive values flow through an operator's template_fields and were registered for masking via mask_secret() on workers or the DAG processor - prior to 3.1.4 these were serialized without calling redact() before being sent to the API server, so they appeared in plaintext in the UI. Limiting factors: the attacker must already hold valid credentials (no unauthenticated access), the affected DAGs/tasks must actually pass secrets through templated fields, and the risk is only meaningful in multi-user/multi-tenant deployments where some users are not authorized to view those secrets. Default single-admin deployments where all users already have full secret access face negligible real exposure.

This is a moderate-severity information disclosure flaw (CVSS 6.5, CWE-201) that should be treated as a patch-soon rather than emergency item. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L), and impact is confidentiality-only (C:H, I:N, A:N) - consistent with exposing secret values without altering data or availability. The EPSS score of 0.48% (39th percentile) is low, and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or widespread exploitation. The signals are mutually consistent rather than conflicting: a real but bounded insider/least-privilege-bypass risk. The attacker must already be an authenticated Airflow UI user, which caps the exposure to environments where lower-privileged users exist and where sensitive values are passed through operator template_fields; the primary value for an attacker is harvesting credentials/secrets they are not authorized to see, enabling lateral movement. Priority should scale with how multi-tenant the Airflow deployment is and whether secrets flow through templated fields.

An authenticated Airflow user with only low-level UI access opens the Rendered Templates view for a task whose templated fields contain secrets (e.g., credentials registered via mask_secret() on workers or the DAG processor). Because those values were not redacted before being sent to the API server/UI, the user reads plaintext secrets they are not authorized to see and can reuse them for lateral movement. No public exploit code is required - this is triggered through normal UI navigation.