In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may
    include proxy URLs containing embedded authentication information. These fields were not treated as
    sensitive by default and therefore were not automatically masked in log output. As a result, when such
    connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.
    Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which
    fixes this issue (CVE-2025-68675)

The version of Apache Airflow installed on the remote host is prior to 3.1.6. It is, therefore, affected by an information disclosure vulnerability:

  - The proxies and proxy fields within a Connection may include proxy URLs containing embedded     authentication information. These fields were not treated as sensitive by default and therefore     were not automatically masked in log output. As a result, when such connections are rendered or     printed to logs, proxy credentials embedded in these fields could be exposed.
    (CVE-2025-68675)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462490	Echo: apache-airflow: security update to 2.11.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
462490	Echo: apache-airflow: security update to 2.11.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
299663	Apache Airflow < 3.1.6 Information Disclosure	Nessus	Misc.	Local	high
436817	SCA: security update for apache-airflow (GHSA-7c2f-r6gc-h92h)	Tenable Cloud Security	SCA Checks	Local	high
436817	SCA: security update for apache-airflow (GHSA-7c2f-r6gc-h92h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-68675

high

Tenable Plugins

high

high

high

high

high