CVE-2026-25219: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Apache Software Foundation Apache Airflow
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data. If you used Azure Service Bus connection with those values set or if you have other connections with those values storing sensitve values, you should upgrade Airflow to 3.1.8
AI Analysis
Technical Summary
Apache Airflow did not mark certain sensitive connection properties ('access_key' and 'connection_string') as sensitive in its secrets masker feature. Consequently, users with read access could see these sensitive values in the Connection UI and logs if connection details were logged. This exposure affects Azure Service Bus connections and potentially other providers using the same fields for sensitive data. The vulnerability is tracked as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). A patch is available in Airflow 3.2.0 to properly mask these fields.
Potential Impact
Users with read permissions in Apache Airflow could access sensitive information such as access keys and connection strings in the UI and logs. This exposure could lead to unauthorized disclosure of credentials used by Azure Service Bus and possibly other services, increasing the risk of unauthorized access to those services. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade Apache Airflow to version 3.2.0 or later, where the sensitive connection properties are properly masked. Since this is a cloud service, the vendor manages remediation for hosted instances, but self-hosted deployments must apply the update. Check the official Apache Airflow advisory for the latest remediation guidance.
CVE-2026-25219: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Apache Software Foundation Apache Airflow
Description
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data. If you used Azure Service Bus connection with those values set or if you have other connections with those values storing sensitve values, you should upgrade Airflow to 3.1.8
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Airflow did not mark certain sensitive connection properties ('access_key' and 'connection_string') as sensitive in its secrets masker feature. Consequently, users with read access could see these sensitive values in the Connection UI and logs if connection details were logged. This exposure affects Azure Service Bus connections and potentially other providers using the same fields for sensitive data. The vulnerability is tracked as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). A patch is available in Airflow 3.2.0 to properly mask these fields.
Potential Impact
Users with read permissions in Apache Airflow could access sensitive information such as access keys and connection strings in the UI and logs. This exposure could lead to unauthorized disclosure of credentials used by Azure Service Bus and possibly other services, increasing the risk of unauthorized access to those services. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade Apache Airflow to version 3.2.0 or later, where the sensitive connection properties are properly masked. Since this is a cloud service, the vendor manages remediation for hosted instances, but self-hosted deployments must apply the update. Check the official Apache Airflow advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-01-30T09:13:59.458Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 69df88bc82d89c981f17bd58
Added to database: 4/15/2026, 12:46:52 PM
Last enriched: 4/15/2026, 1:02:12 PM
Last updated: 4/15/2026, 6:10:00 PM
Views: 31
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.