PT-2025-51039

CVE-2025-65995

Published

2025-12-12

Updated

2026-07-13

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.1.4 Airflow versions prior to 2.11.1

Description A flaw exists in Airflow where the user interface (UI) error reporting could expose sensitive information passed as keyword arguments (kwargs) to operators when a Directed Acyclic Graph (DAG) failed during parsing. This exposure was limited to authenticated users with permission to view the affected DAG. The issue could lead to the disclosure of secrets or other sensitive values included within the kwargs.

Recommendations Upgrade to Airflow version 3.1.4 or later. Upgrade to Airflow version 2.11.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Frieder Gottman

Jens Scheffler

Vendors

Affected products

Weakness enumeration

CWE-209: Generation of Error Message Containing Sensitive Information