CVE-2025-66236
2 advisories.
PyPI/apache-airflow CVE-2025-66236: medium
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Action: Upgrade apache-airflow to 3.2.0 or later.
pip install apache-airflow==3.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.0 | - |
Fixed versions
| 3.2.0 |
Sources
- osv: GHSA-j86x-fwp2-qh7v
- https://nvd.nist.gov/vuln/detail/CVE-2025-66236
- https://github.com/apache/airflow/pull/58662
- https://airflow.apache.org/blog/airflow-3.2.0
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-8.yaml
- https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo
- http://www.openwall.com/lists/oss-security/2026/04/13/6
CVE-2025-66236 · published · modified · JSON
PyPI/apache-airflow CVE-2025-66236: high 7.5
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Som
Action: Upgrade apache-airflow to 3.2.0 or later.
pip install apache-airflow==3.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.0 | - |
Fixed versions
| 3.2.0 |
Sources
- osv: PYSEC-2026-8
- http://www.openwall.com/lists/oss-security/2026/04/13/6
- https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo
- https://github.com/apache/airflow/pull/58662
- https://github.com/advisories/GHSA-j86x-fwp2-qh7v
CVE-2025-66236 · published · modified · JSON