Executive brief
Apache Airflow, a platform used to programmatically author and monitor workflows, contains a vulnerability where sensitive information like passwords or API keys could be exposed. Authenticated users with access to the user interface could view these secrets in plain text within rendered templates because the system failed to properly mask them. This could lead to unauthorized access to external systems or sensitive data if an attacker uses the exposed credentials.
Technical details
A vulnerability in Apache Airflow (CWE-201) exists where secrets registered via the Task SDK's secrets masker are not properly redacted when displayed in the Rendered Templates view of the UI. The root cause is a discrepancy between the Task SDK's secrets masker and the Airflow core secrets masker; because they use different import paths, the core masker used by the API server fails to recognize and apply patterns registered by the SDK masker on the worker. An authenticated attacker with UI access can view these unmasked secrets in the 'Rendered Template' tab of a task instance. The issue is resolved in version 3.1.4 by ensuring redaction occurs at the worker level before data is transmitted to the API server.
Affected products
- Apache apache-airflow >= 3.1.0, < 3.1.4
Timeline
- 2025-11-27: patched: Fix merged into main branch via PR 58767
- 2025-12-12: disclosed: Public disclosure on oss-security mailing list
- 2025-12-15: advisory: GitHub and NVD advisories published