id: PYSEC-2025-85
published: "2025-09-26T08:15:38.303Z"
modified: "2025-11-04T22:16:29.567Z"
aliases:
- CVE-2025-54831
- GHSA-q475-2pgm-7hvp
details: "Apache Airflow 3 introduced a change to the handling of sensitive information
  in Connections. The intent was to restrict access to sensitive connection fields
  to Connection Editing Users, effectively applying a \"write-only\" model for sensitive
  values.\n\n\nIn Airflow 3.0.3, this model was unintentionally violated: sensitive
  connection information could be viewed by users with READ permissions through both
  the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS`
  configuration option.\n\n\nThis issue does not affect Airflow 2.x, where exposing
  sensitive information to connection editors was the intended and documented behavior.\n
  \n\n\n\n\n\nUsers of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4."
affected:
- package:
    name: apache-airflow
    ecosystem: PyPI
    purl: pkg:pypi/apache-airflow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 3.0.3-NA
  ecosystem_specific: {}
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2025/09/25/4
- type: ARTICLE
  url: https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf
- type: ADVISORY
  url: https://github.com/advisories/GHSA-q475-2pgm-7hvp
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N