CVE-2025-68438: Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered masksecret() patterns, so secrets were not reliably masked before truncation and display.
Users are recommended to upgrade to 3.1.6 or later, which fixes this issue
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68438?
CVE-2025-68438 has a moderate severity rating due to the potential exposure of sensitive information.
How do I fix CVE-2025-68438?
To fix CVE-2025-68438, upgrade Apache Airflow to version 3.1.6 or later.
What versions are affected by CVE-2025-68438?
CVE-2025-68438 affects Apache Airflow versions prior to 3.1.6.
What kind of data could be exposed in CVE-2025-68438?
CVE-2025-68438 could expose parts of sensitive values in cleartext within rendered template fields.
In which component of Apache Airflow does CVE-2025-68438 occur?
CVE-2025-68438 occurs in the Rendered Templates UI of Apache Airflow.