Apache Airflow Vulnerability Lets Read-Only Users Access Sensitive Data

Apache Airflow maintainers have disclosed a serious security issue, tracked as CVE-2025-54831, that allows users holding only read permissions to view sensitive connection details via both the Airflow API and the web interface. The vulnerability affects Airflow version 3.0.3, undermining the project’s intended write-only masking of secrets in Connections, which could expose credentials and other secret configuration data.

Read-only users could retrieve full sensitive values through HTTP GET requests to /api/v1/connections/{connection_id} or by viewing the Connection details page in the UI, bypassing the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS configuration. In early reporting, the issue was publicly raised on the developer mailing list by Kaxil Naik on 25 September 2025, and both the API and UI exposure include fields such as passwords, host details, tokens and SSH private keys.

Apache Airflow fixed the flaw in version 3.0.4, restoring the intended masking, with a recommended upgrade and a workaround involving a proxy or API gateway if immediate upgrade is not possible. Administrators are advised to upgrade to Airflow 3.0.4, audit RBAC policies, and review downstream systems accessed via exposed connections to mitigate potential compromise.