When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed
    to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in
    the UI tracebacks to authenticated users who had permission to view that DAG. The issue has been fixed in
    Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of
    sensitive information. (CVE-2025-65995)

ID	Name	Product	Family	Type	Severity
460844	Echo: apache-airflow: security update to 2.11.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460844	Echo: apache-airflow: security update to 2.11.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
437993	SCA: security update for apache-airflow (GHSA-gfw7-2v73-69wg)	Tenable Cloud Security	SCA Checks	Local	medium
437993	SCA: security update for apache-airflow (GHSA-gfw7-2v73-69wg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-65995

medium

Tenable Plugins

medium

medium

medium

medium