CVE-2025-54831: Apache Airflow: Connection sensitive details exposed to users with READ permissions
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.
In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the AIRFLOWCOREHIDESENSITIVEVARCONNFIELDS configuration option.
This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.
Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 3.0.4 - Upgrade
Upgrade
Apache Airflowto a version that resolves this vulnerability.Fixed in 3.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54831?
CVE-2025-54831 has been rated as a moderate severity vulnerability.
How do I fix CVE-2025-54831?
To fix CVE-2025-54831, you should upgrade to Apache Airflow version 3.0.4 or later.
What types of information are affected by CVE-2025-54831?
CVE-2025-54831 impacts the handling of sensitive connection fields in Apache Airflow.
Who is affected by CVE-2025-54831?
Users of Apache Airflow version 3.0.3 who manage sensitive connection fields are affected by CVE-2025-54831.
What changes were introduced in relation to CVE-2025-54831?
CVE-2025-54831 introduced a 'write-only' model for sensitive values in connection handling.