CVE-2025-66236
Published: 13 April 2026
Summary
CVE-2025-66236 is a high-severity Insertion of Sensitive Information into Log File (CWE-532) vulnerability in Apache Airflow. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely flaw remediation, including upgrading to Airflow 3.2.0 which fixes unclear documentation on security model, workload isolation, and JWT authentication.
CM-6 requires establishing, documenting, implementing, and monitoring secure configuration settings that prevent misconfigurations from incorrect assumptions about Airflow's security model.
CM-2 ensures development and maintenance of baseline configurations under control, enabling secure Airflow deployments aligned with clarified workload isolation and authentication details.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unclear documentation enables misconfigurations in public-facing Airflow (auth/JWT/workload isolation), directly facilitating unauthenticated network exploitation for data access.
NVD Description
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or…
more
explicit enough, even though Airflow's intentions and security model of Airflow did not suggest different assumptions. The overall security model [1], workload isolation [2], and JWT authentication details [3] are now described in more detail. Users concerned with role isolation and following the Airflow security model of Airflow are advised to upgrade to Airflow 3.2, where several security improvements have been implemented. They should also read and follow the relevant documents to make sure that their deployment is secure enough. It also clarifies that the Deployment Manager is ultimately responsible for securing your Airflow deployment. This had also been communicated via Airflow 3.2.0 Blog announcement [4]. [1] Security Model: https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html [2] Workload isolation: https://airflow.apache.org/docs/apache-airflow/stable/security/workload.html [3] JWT Token authentication: https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html [4] Airflow 3.2.0 Blog announcement: https://airflow.apache.org/blog/airflow-3.2.0/ Users are recommended to upgrade to version 3.2.0, which fixes this issue.
Deeper analysisAI
CVE-2025-66236 affects Apache Airflow versions prior to 3.2.0. The issue arises from unclear documentation on secure deployment requirements, where deployment managers might make incorrect assumptions about Airflow's security model, workload isolation, and JWT authentication details. Although Airflow's intentions did not suggest alternative assumptions, these aspects were not explicit enough, potentially leading to insecure configurations. The vulnerability is classified under CWE-532 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Unauthenticated attackers with network access can exploit misconfigurations resulting from these unclear assumptions. By leveraging deployment managers' failure to properly implement Airflow's security model, attackers can achieve high confidentiality impact, such as unauthorized access to sensitive data.
Advisories recommend upgrading to Airflow 3.2.0, which implements several security improvements and provides more detailed documentation on the security model (https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html), workload isolation (https://airflow.apache.org/docs/apache-airflow/stable/security/workload.html), and JWT token authentication (https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html). The Airflow 3.2.0 blog announcement (https://airflow.apache.org/blog/airflow-3.2.0/) further clarifies responsibilities, emphasizing that deployment managers are ultimately accountable for securing their Airflow deployments. Additional references include the fix in GitHub pull request #58662 and announcements on Apache mailing lists.
Details
- CWE(s)