Apache Airflow 3.0.3 contains a vulnerability where sensitive connection information can be viewed by users with READ permissions, violating the intended 'write-only' model for sensitive fields. This exposure bypasses the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS configuration. The issue does not affect Airflow 2.x versions. Users are advised to upgrade to Airflow 3.0.4 or later to resolve this issue.