{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.0.3-NA"}],"component":"apache-airflow","cve_ids":["CVE-2025-54831"],"ecosystem":"PyPI","epss":0.00935,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-q475-2pgm-7hvp","id":"tcs_01M5KGPXG7WRHNH4XQ3PHY4M2H","modified_at":"2026-06-10T17:00:26.441514282Z","published_at":"2025-09-26T08:15:38.303Z","references":["https://osv.dev/vulnerability/PYSEC-2025-85","http://www.openwall.com/lists/oss-security/2025/09/25/4","https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf","https://github.com/advisories/GHSA-q475-2pgm-7hvp"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2025-85","url":"https://osv.dev/vulnerability/PYSEC-2025-85"}],"summary":"Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively"}