Executive brief
Apache Airflow, a platform used to schedule and monitor workflows, was found to leak sensitive proxy credentials in its task logs. If a connection uses a proxy URL that includes a username and password, these details were not automatically hidden and could be viewed by anyone with access to the logs. This could allow unauthorized individuals to gain access to internal proxy services or other protected network resources.
Technical details
A vulnerability in Apache Airflow (CWE-532) causes the 'proxies' and 'proxy' fields within a Connection object to be treated as non-sensitive by default. When these fields contain URLs with embedded authentication (e.g., http://user:pass@proxy), the credentials are not automatically masked by the secrets_masker component. Consequently, these plain-text credentials may be exposed in task logs when connections are rendered or printed. Attackers with access to log output can harvest these credentials to compromise proxy services. The issue is resolved in versions 2.11.1 and 3.1.6 by adding these fields to the default sensitive fields list.
Affected products
- Apache Airflow < 2.11.1, >= 3.0.0b1, < 3.1.6
Timeline
- 2025-12-24: patched: Pull request merged to fix secret logging in Microsoft Graph hook
- 2026-01-15: disclosed: Mailing list announcement on oss-security
- 2026-01-16: advisory: GitHub Advisory and NVD entry published