CVE-2025-65995: 
Apache Airflow vulnerability analysis and mitigation

CVE-2025-65995 is an information disclosure vulnerability in Apache Airflow where DAG parsing failures could expose sensitive operator kwargs — including secrets such as API keys, passwords, and cloud credentials — in UI tracebacks. The flaw affects Apache Airflow versions before 2.11.1 and versions 3.0.0 through 3.1.3 (fixed in 3.1.4). It was discovered by Frieder Gottman (Cariad) and reported by Jens Scheffler (Bosch), with public disclosure on December 12, 2025 via the oss-security mailing list. The CVSS v3.1 base score is 6.5 (Medium) (Feedly, oss-security).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). When a DAG contains top-level code that causes a parsing failure, Airflow's error-reporting mechanism in the UI includes the full kwargs dictionary passed to operators in the resulting traceback. If those kwargs contain sensitive values (e.g., secrets, passwords, connection strings), they are rendered in plaintext in the UI for any authenticated user with DAG view permissions. The fix, implemented in PR #58252 (for Airflow 3.x) and PR #61883 (for Airflow 2.11.x), masks kwargs in illegal-argument error messages before they are displayed or written to the database, covering both sensitive values and kwargs with sensitive-sounding parameter names (GitHub PR #58252, GitHub PR #61883, oss-security).

Successful exploitation allows authenticated users with DAG view permissions to read sensitive secrets — such as AWS/Azure credentials, database passwords, and API keys — that were passed as operator kwargs, if those DAGs fail during parsing. The confidentiality impact is high, with no integrity or availability impact. In environments where DAG authors embed credentials directly in operator arguments (a common anti-pattern), this could lead to lateral movement or unauthorized access to downstream cloud services and databases (Feedly, oss-security).

1. Reconnaissance: Identify an Apache Airflow instance running a vulnerable version (before 2.11.1 or 3.0.0–3.1.3) with DAGs that pass sensitive values (e.g., passwords, API keys) directly as operator kwargs.
2. Authenticate: Log in to the Airflow UI with any account that has permission to view DAGs.
3. Trigger or await a DAG parsing failure: A DAG that uses top-level code with invalid operator arguments (e.g., unsupported kwargs) will fail during parsing. This may already be occurring in environments with misconfigured DAGs.
4. View the traceback: Navigate to the affected DAG in the Airflow UI. The parsing error traceback displayed in the UI will include the full kwargs dictionary, potentially exposing secrets in plaintext.
5. Harvest credentials: Extract sensitive values (e.g., cloud credentials, database passwords) from the displayed traceback for use in further attacks (GitHub PR #58252, oss-security).

Apache Airflow has released patched versions 2.11.1 and 3.1.4 that mask kwargs in error messages before display. Users should upgrade to one of these versions immediately. As a general best practice, avoid embedding secrets directly in DAG operator kwargs; instead, use Airflow's Connections and Variables with a secrets backend (e.g., HashiCorp Vault, AWS Secrets Manager). No configuration-based workaround is available for unpatched versions (GitHub PR #58252, GitHub PR #61883, oss-security).

The vulnerability was discussed on the oss-security mailing list following the December 12, 2025 disclosure, with community members noting the risk in environments where secrets are passed directly as operator arguments. A blog post titled "CVE-2025-65995: Critical Data Pipeline Failure — Airflow Flaw Prints All Your Cloud Secrets" highlighted the potential severity for organizations using cloud credentials in DAGs. Security aggregators including SecurityOnline.info covered the disclosure, noting it alongside related Airflow template rendering issues (oss-security, SecurityOnline).