affected:
- package:
    ecosystem: PyPI
    name: apache-airflow
    purl: pkg:pypi/apache-airflow
  ranges:
  - events:
    - introduced: 3.1.0
    - fixed: 3.1.4
    type: ECOSYSTEM
  versions:
  - 3.1.0
  - 3.1.1
  - 3.1.1rc1
  - 3.1.1rc2
  - 3.1.2
  - 3.1.2rc1
  - 3.1.2rc2
  - 3.1.3
  - 3.1.3rc1
  - 3.1.4rc1
  - 3.1.4rc2
aliases:
- CVE-2025-66388
- GHSA-fv47-pqh6-wxgq
details: "A vulnerability in Apache Airflow allowed authenticated UI users to view
  secret values in rendered templates due to secrets not being properly redacted, potentially
  exposing secrets to users without the appropriate authorization.\n\nUsers are recommended
  to upgrade to version 3.1.4, which fixes this issue."
id: PYSEC-2025-86
modified: '2026-05-20T09:18:52.544639Z'
published: '2025-12-15T12:15:40.573Z'
references:
- type: ADVISORY
  url: http://www.openwall.com/lists/oss-security/2025/12/12/1
- type: ADVISORY
  url: https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g
- type: REPORT
  url: https://github.com/apache/airflow/pull/58772
- type: ADVISORY
  url: https://github.com/advisories/GHSA-fv47-pqh6-wxgq
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3