CVE-2025-54831: Apache Airflow Bug Exposes Sensitive Connection Passwords to Read-Only Users

CVE-2025-54831 concerns a bug in Apache Airflow 3.0.3 that allowed users with READ permissions to view sensitive connection details via both the API and the UI, undermining the intended write-only model for sensitive values. According to the advisory, the change introduced in Airflow 3 to limit access to sensitive information was unintentionally broken in version 3.0.3, bypassing the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS configuration option.

The flaw meant that passwords, tokens and other credentials linked to Airflow’s connections could be accessed by those with viewing rights, rather than being strictly hidden. The issue does not affect earlier Airflow 2.x versions, for which exposing sensitive information to connection editors was described as the intended and documented behaviour. The Apache Software Foundation has issued a fix and urged users of version 3.0.3 to upgrade immediately.