CVE-2025-68675
📋 TL;DR
Apache Airflow versions before 3.1.6 expose proxy credentials in logs when connections contain proxy URLs with embedded authentication. This allows attackers with log access to steal credentials. All Airflow deployments using proxy connections with authentication are affected.
💻 Affected Systems
- Apache Airflow
📦 What is this software?
Airflow by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain proxy credentials, pivot to internal networks, compromise sensitive systems, and potentially achieve full environment takeover.
Likely Case
Credential theft leading to unauthorized access to proxy-protected resources, data exfiltration, or lateral movement within the network.
If Mitigated
Limited to credential exposure without actual compromise if logs are properly secured and monitored.
🎯 Exploit Status
Exploitation requires access to Airflow logs where proxy connection details are printed. No special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.6 or later
Vendor Advisory: https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5
Restart Required: Yes
Instructions:
1. Backup your Airflow configuration and database. 2. Upgrade Airflow to version 3.1.6 or later using pip: 'pip install --upgrade apache-airflow==3.1.6'. 3. Restart all Airflow services (webserver, scheduler, workers). 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable proxy logging
allConfigure Airflow to not log connection details containing proxy URLs
Set log level to WARNING or higher for connection-related logs in airflow.cfg
Remove embedded credentials
allReplace proxy URLs containing embedded credentials with separate credential storage
Update connections to use Airflow's secrets backend for proxy credentials instead of embedding in URLs
🧯 If You Can't Patch
- Implement strict access controls on Airflow log files and directories
- Monitor and alert on any access to logs containing connection or proxy information
🔍 How to Verify
Check if Vulnerable:
Check Airflow version: if below 3.1.6 and using proxy connections with embedded credentials, you are vulnerable.Check Version:
airflow versionVerify Fix Applied:
After upgrade to 3.1.6+, test that proxy URLs in connection logs are masked (show as '***' instead of actual credentials).📡 Detection & Monitoring
Log Indicators:
- Log entries containing proxy URLs with visible username:password@ format
- Connection details in logs showing unmasked authentication
Network Indicators:
- Unusual proxy authentication attempts from unexpected sources
SIEM Query:
source="airflow.logs" AND ("proxy" AND ("http://" OR "https://") AND "@")