CVE-2025-66388

Опубликовано: 15 дек. 2025

Источник: nvd

CVSS3: 6.5

CVSS3: 4.3

EPSS Низкий

Описание

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.

Users are recommended to upgrade to version 3.1.4, which fixes this issue.

Ссылки

https://github.com/apache/airflow/pull/58772
Issue Tracking
https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/12/1
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

Версия от 3.1.0 (включая) до 3.1.4 (исключая)

EPSS

Процентиль: 13%

0.00042

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-201

Связанные уязвимости

CVE-2025-66388

CVSS3: 6.5

debian

около 2 месяцев назад

A vulnerability in Apache Airflow allowed authenticated UI users to vi ...

GHSA-fv47-pqh6-wxgq

CVSS3: 6.5

github

около 2 месяцев назад

Apache Airflow exposes secret values to authenticated UI users via rendered templates

EPSS

Процентиль: 13%

0.00042

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-201