Apache Airflow: Disclosure of secrets to UI via kwargs(CVE-2025-65995)

概要

Apache Airflow: Disclosure of secrets to UI via kwargs

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.

The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami airflow

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.1"},{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]

参照URL

advisory openwall.com
advisory lists.apache.org
patch github.com
patch github.com
web nvd.nist.gov