CVE-2025-68675: Apache Airflow: proxy credentials for various providers might leak in task logs
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.
Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue
Other sources
In Apache Airflow versions before 3.1.6, the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.
Users are recommended to upgrade to 3.1.6 or later, which fixes this issue
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68675?
CVE-2025-68675 is considered a high severity vulnerability due to the potential exposure of sensitive proxy credentials in task logs.
How do I fix CVE-2025-68675?
To mitigate CVE-2025-68675, update Apache Airflow to version 3.1.6 or later.
What specific problem does CVE-2025-68675 address?
CVE-2025-68675 addresses the leaking of proxy credentials in task logs due to proxy URLs containing embedded authentication information.
In which versions of Apache Airflow is CVE-2025-68675 present?
CVE-2025-68675 affects Apache Airflow versions prior to 3.1.6.
Are proxy credentials secure in Apache Airflow prior to version 3.1.6 due to CVE-2025-68675?
No, proxy credentials are not secure in Apache Airflow versions prior to 3.1.6, as they may be exposed in task logs.