PT-2026-33058

CVE-2026-25219

Published

2026-04-15

Updated

2026-07-13

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.1.8

Description The secrets masker failed to mark the access key and connection string connection properties as sensitive. This allows users with read permissions to view these values in the Connection UI. Additionally, if a Connection is accidentally recorded in logs, these values are exposed. Azure Service Bus uses these properties to store sensitive data, and other providers using the same fields may also be affected.

Recommendations Upgrade to version 3.1.8.

Exploitability

Exploit

Fix

Impacts

Researchers

Saurabh Banawar

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers