Vulnerability · Published Jan 16, 2026 · Assigned by apache
CVE-2025-68675Apache Airflow: proxy credentials for various providers might leak in task logs
High 7.5
In plain English
A high-severity sensitive data in logs in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow | 3.1.6 | GHSA-7c2f-r6gc-h92h |
| PyPI | apache-airflow | 2.11.1 | GHSA-7c2f-r6gc-h92h |
| PyPI | apache-airflow | 3.1.6 | PYSEC-2026-10 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 – before 2.11.1 |
| Apache Software Foundation | Apache Airflow | 3.0.0 – before 3.1.6 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N