CVE-2025-66388

Katalog CVE

CVSS 6.5 · Medium EPSS 0,48%

Kerentanan Insertion of Sensitive Information Into Sent Data pada apache airflow. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this issue.

Rincian

Terbit di NVD

15 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/12/12/1 mailing list · advisory pihak ketiga
• https://github.com/apache/airflow/pull/58772 issue tracking