CVE-2025-65995

Katalog CVE

CVSS 6.5 · Medium EPSS 0,82%

Kerentanan Generation of Error Message Containing Sensitive Information pada apache airflow. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.  The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 55,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2 mailing list · advisory vendor
• https://github.com/apache/airflow/pull/58252 issue tracking · patch
• https://github.com/apache/airflow/pull/61883 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2025/12/12/2 mailing list · advisory pihak ketiga