Cyber Resilience

CVE-2025-66388

Info Disclosure in Apache Airflow 3.1.0 – 3.1.4

Published
15 December 2025
Modified
16 December 2025
Patch / advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0041 34th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-66388 is a medium-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Apache Airflow. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4,…

more

which fixes this issue.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Why these techniques?

Improper secret redaction in rendered templates directly enables viewing of unsecured credentials by authorized UI users.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-48828Same product: Apache Airflow
CVE-2026-49487Same product: Apache Airflow
CVE-2026-48892Same product: Apache Airflow
CVE-2026-32690Same product: Apache Airflow
CVE-2026-25219Same product: Apache Airflow
CVE-2026-45192Same product: Apache Airflow
CVE-2025-68675Same product: Apache Airflow
CVE-2025-65995Same product: Apache Airflow
CVE-2026-42360Same product: Apache Airflow
CVE-2024-50378Same product: Apache Airflow

Affected Assets

apache
airflow
3.1.0 — 3.1.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-4 Information Flow Enforcement
  • SI-15 Information Output Filtering
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V14.2.3

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authorization decisions so that UI users without secret access rights cannot view redacted values in rendered templates.

prevent

Enforces information-flow rules that prevent secret values from being released through rendered template output to unauthorized authenticated users.

prevent

Requires filtering of system output to suppress sensitive data such as secrets that were not properly redacted before display.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.

DE.CM-09 partial match
prevents

Monitoring runtime data flows and outputs can detect sensitive data being transmitted.

PR.DS-02 partial match
prevents

Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.

PR.DS-10 partial match
prevents

Protecting data-in-use includes removing confidential values before they are processed or sent.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.

mitigates

Classification identifies sensitive data so it is not inadvertently transmitted.

mitigates

Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.

mitigates

Information-transfer rules directly govern what data may be sent to external parties.

mitigates

PII-protection requirements reduce the chance of sending personal data to unauthorized recipients.

mitigates

DLP controls inspect and block outbound flows that contain sensitive information.

References