CVE-2025-27555: 
Apache Airflow vulnerability analysis and mitigation

CVE-2025-27555 is an information disclosure vulnerability in Apache Airflow that allows authenticated users with audit log access to view sensitive connection parameters in plaintext within audit logs. Affected versions are all Apache Airflow releases prior to 2.11.1. When sensitive connection parameters (such as passwords or tokens) are set via the Airflow CLI, those values are written unencrypted to the audit log and stored unencrypted in the Airflow database. The vulnerability was disclosed on February 24, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Apache Mailing List). It is related to, but distinct from, the previously disclosed CVE-2024-50378.

The root cause is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) and CWE-532 (Insertion of Sensitive Information into Log File). When a user sets connection parameters — including passwords, API keys, or other secrets — via the Airflow CLI using JSON or URI formats, the Airflow application fails to mask or redact those sensitive values before writing the corresponding audit log entry. As a result, the plaintext secrets are persisted unencrypted in the log table of the Airflow database and are visible to any authenticated user who has been granted audit log access permissions. The fix, implemented in pull request #61882, adds masking for connection details when creating connections via JSON and URI (GitHub PR, Apache Mailing List).

Successful exploitation allows authenticated users with audit log access to read sensitive connection credentials — such as database passwords, API tokens, and other secrets — that were set via the CLI, even if those users are not authorized to view the underlying connection configurations. These credentials are stored unencrypted in the Airflow database, meaning a database-level compromise could also expose them. The confidentiality impact is rated High, with no direct integrity or availability impact; however, exposed credentials could enable lateral movement to connected systems such as databases, cloud services, or data warehouses (Red Hat CVE, Apache Mailing List).

1. Obtain valid credentials: Acquire an Airflow account that has been granted audit log access permissions (e.g., through insider access or credential theft).
2. Identify CLI-configured connections: Determine whether any Airflow connections were created or updated using the Airflow CLI with JSON (--conn-extra) or URI formats, as these are the vectors that trigger unmasked logging.
3. Access the audit log: Log into the Airflow web UI or query the Airflow database directly, and navigate to the audit log (Admin > Audit Logs in the UI, or query the log table in the database).
4. Extract sensitive values: Search audit log entries for connection creation or update events; the sensitive parameters (passwords, tokens, etc.) will appear in plaintext within the log entries.
5. Leverage exposed credentials: Use the extracted credentials to authenticate to connected external systems (databases, cloud APIs, etc.) for further access or lateral movement (GitHub PR, Apache Mailing List).

• Logs: Airflow audit log entries (in the log table) containing connection creation or update events with plaintext sensitive parameters such as passwords or tokens in the extra or uri fields.
• Database: Unencrypted credential strings visible in the log table of the Airflow metadata database, particularly in rows where event is connection.create or connection.edit and the extra column contains JSON with sensitive keys (e.g., password, token, secret).
• Access Patterns: Unusual or unexpected queries against the Airflow log table by users who do not normally access audit logs; repeated access to the Admin > Audit Logs section of the Airflow UI by non-administrative accounts.

Upgrade Apache Airflow to version 2.11.1 or later, which masks sensitive connection parameters before writing audit log entries (GitHub PR, Apache Mailing List). Organizations that previously used the Airflow CLI to set connections should manually delete log table entries containing sensitive values from the Airflow metadata database. As an interim control, restrict audit log access (Admin > Audit Logs) to only those users who strictly require it, and review existing audit logs for any exposed credentials that may need to be rotated.

The vulnerability was announced via the Apache security mailing list and picked up by standard vulnerability tracking services including Red Hat, VulnDB, and OSS-Sec shortly after disclosure (Apache Mailing List, Red Hat CVE). A brief write-up was published by Infinitsec noting that connection secrets are not masked in the UI when connections are added via CLI. No significant broader media coverage or notable researcher commentary beyond standard advisory distribution has been observed.