CVE-2025-54831: Apache Airflow · Exposure of Sensitive Information Due to Incompatible Policies
Affects Apache AirflowSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 26 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software Foundation Apache Airflow | Affected
| Fixed in– |
AI-suggested
1. Upgrade Apache Airflow installations from version 3.0.3 to 3.0.4 or later immediately to apply the official fix. 2. Review and tighten user role assignments, ensuring that only trusted users have read access to connection objects containing sensitive information. 3. Implement strict access control policies and segregate duties to minimize the number of users with read permissions on sensitive connections. 4. Enable and monitor audit logging for access to connection data to detect any unauthorized or unusual read activity. 5. Use environment-level encryption and secrets management solutions external to Airflow where possible to reduce sensitive data exposure within Airflow itself. 6. Regularly review Airflow configuration settings, especially AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS, to ensure they are correctly applied and effective. 7. Educate administrators and users about the sensitivity of connection information and the importance of least privilege principles. 8. Consider network segmentation and additional authentication controls (e.g., MFA) for Airflow UI and API access to reduce risk of compromised credentials being misused.
Description
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option. This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior. Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.