- Description
- In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue
- Source
- security@apache.org
- NVD status
- Modified
- Products
- airflow
CVSS 3.1
- Type
- Secondary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity
- HIGH
- security@apache.org
- CWE-532
- Hype score
- Not currently trending
⚠️ Vulnerabilidades en productos Apache ❗ CVE-2025-68675 ❗ CVE-2025-68438 ❗ CVE-2025-60021 ➡️ Más info: https://t.co/pFFA5LPHue https://t.co/lS0GELcr0e
@CERTpy
22 Jan 2026
65 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-68438 & CVE-2025-68675: Why Your Airflow Secrets are Leaking in Plain Sight. Read the full report on - https://t.co/1OhWD6rI4f https://t.co/jqVf3YGF7H
@cyberbivash
20 Jan 2026
1 Impression
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Apache Airflow Bugs Can Leak Proxy Credentials and Secrets via Logs and the Web UI Two Airflow flaws (CVE-2025-68675, CVE-2025-68438) in versions <3.1.6 can expose proxy usernames/passwords in task logs and leak sensitive templated secrets in the Rendered Templates UI due
@ThreatSynop
20 Jan 2026
31 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-68675: Airflow Leaks: When Proxies Spill Secrets in the Logs Apache Airflow versions prior to 3.1.6 failed to mask sensitive credentials embedded within proxy URLs in connection configurations, leading to clear-text password exposure in execu... https://t.co/zVzt0ONdTa
@_cvereports
18 Jan 2026
49 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-68675 In Apache Airflow versions before 3.1.6, the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These… https://t.co/P1rCMupZJR
@CVEnew
16 Jan 2026
54 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-68438: Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated https://t.co/4aUKozFsUP CVE-2025-68675: Apache Airflow: proxy credentials for various providers might leak in task logs https://t.co/cLjh7O7Cmz
@oss_security
16 Jan 2026
669 Impressions
2 Retweets
9 Likes
5 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "871CDA8B-4EBD-4FDA-9875-D875BBEF49B5",
"versionEndExcluding": "3.1.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]