CVE-2025-68675: Apache Airflow Proxy Credentials Leakage in Task Logs
Summary
CVE-2025-68675: Apache Airflow proxy credentials for various providers might leak in task logs. Affects apache-airflow versions < 3.1.6. Fixed in 3.1.6. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2025-68675 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as directed acyclic graphs (DAGs) and provides a rich user interface to manage and visualize these workflows. However, prior to version 3.1.6, Airflow had a vulnerability that could expose sensitive proxy credentials in task logs, potentially compromising security.
Vulnerability Detail
In Apache Airflow versions before 3.1.6, the proxies and proxy fields within a Connection could contain proxy URLs with embedded authentication information. These fields were not treated as sensitive by default, leading to their exposure in log outputs when rendered or printed. This could allow unauthorized access to sensitive information, posing a significant security risk.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.6
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.1.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually mask or avoid logging sensitive proxy fields in their task logs until they can upgrade to the patched version.
Conclusion
The vulnerability identified as CVE-2025-68675 in Apache Airflow poses a significant risk by potentially exposing sensitive proxy credentials in task logs. Users are strongly encouraged to upgrade to version 3.1.6 or later to mitigate this risk and ensure the security of their workflows.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2025-68675 is a vulnerability in Apache Airflow that allows proxy credentials to be exposed in task logs due to improper handling of sensitive information.
Apache Airflow versions prior to 3.1.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot upgrade immediately, consider masking sensitive proxy fields in your logs as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
