CVE-2025-66388
📋 TL;DR
This vulnerability in Apache Airflow allows authenticated users with UI access to view secret values in rendered templates due to improper redaction. This exposes sensitive secrets like passwords, API keys, and tokens to users who shouldn't have access. All Apache Airflow instances with authenticated UI users are affected.
💻 Affected Systems
- Apache Airflow
📦 What is this software?
Airflow by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to all secrets stored in Airflow, leading to complete compromise of connected systems, databases, and external services.
Likely Case
Internal users accidentally or intentionally view secrets they shouldn't access, leading to data exposure and potential privilege escalation.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized users who might still see secrets beyond their intended scope.
🎯 Exploit Status
Exploitation requires authenticated UI access and involves viewing rendered templates in the Airflow UI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.4
Vendor Advisory: https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g
Restart Required: Yes
Instructions:
1. Backup your Airflow configuration and database. 2. Upgrade Apache Airflow to version 3.1.4 using pip: 'pip install apache-airflow==3.1.4'. 3. Restart all Airflow services (webserver, scheduler, workers). 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict UI Access
allLimit UI access to only trusted administrators who require it for operations.
Disable Template Rendering
allDisable the template rendering feature in the UI if not required for your workflows.
🧯 If You Can't Patch
- Rotate all secrets stored in Airflow immediately to limit exposure.
- Implement strict access controls and audit logs for UI access to detect unauthorized viewing.
🔍 How to Verify
Check if Vulnerable:
Check your Apache Airflow version; if it's below 3.1.4, you are vulnerable. Authenticated users can test by viewing rendered templates in the UI to see if secrets are redacted.Check Version:
airflow versionVerify Fix Applied:
After upgrading to 3.1.4, verify that secret values are properly redacted in rendered templates when viewed by authenticated users in the UI.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to template rendering endpoints in Airflow webserver logs.
- Multiple failed or successful attempts to view rendered templates by non-admin users.
Network Indicators:
- Increased traffic to Airflow UI endpoints related to template rendering.
SIEM Query:
source="airflow_webserver.log" AND ("rendered" OR "template") AND user!="admin"