Apache Airflow Flaws Leak Sensitive Credentials in UI via DAG Tracebacks & Template Rendering

The maintainers of Apache Airflow have released version 3.1.4 to fix two vulnerabilities that could expose sensitive credentials in the UI. The more severe issue, CVE-2025-65995, is rated Moderate and concerns error reporting during DAG parsing, where detailed traceback reports could include full operator kwargs and reveal secrets to authenticated users.

A second vulnerability, CVE-2025-66388, rated Low, involves how templates are rendered, with secrets not being properly redacted, potentially exposing values to users without appropriate authorization. The advisory explains that if kwargs contained sensitive values, they might appear in UI tracebacks; similarly, redaction failures in template rendering could break the authorization boundary by showing secrets in rendered templates.

Both vulnerabilities affect Airflow versions prior to 3.1.4, and administrators are urged to update their instances immediately. December 13, 2025. according to seclists[.]org