CVE-2025-68675: 
Apache Airflow vulnerability analysis and mitigation

CVE-2025-68675 is an information disclosure vulnerability in Apache Airflow where proxy credentials embedded in Connection fields may be exposed in task log output. Affected versions include Apache Airflow before 3.1.6 (Airflow 3.x) and before 2.11.1 (Airflow 2.x). The vulnerability was disclosed on January 15–16, 2026, with the CVE published by the Apache Software Foundation on January 16, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). The proxies and proxy fields within an Airflow Connection object can contain proxy URLs with embedded authentication credentials (e.g., http://user:password@proxy-host:port). These fields were not designated as sensitive by default, so Airflow's log masking mechanism did not automatically redact them. When tasks render or print Connection objects to logs — a common occurrence during task execution — the plaintext proxy credentials appear in task log output accessible to anyone with log read access. The fix, introduced via pull request apache/airflow#59688, marks these fields as sensitive so they are masked in log output (Github Advisory, Openwall OSS-Sec).

Successful exploitation results in the exposure of proxy authentication credentials (usernames and passwords) stored within Airflow Connections. An attacker with access to Airflow task logs — which may be accessible to multiple users in a shared Airflow environment — could harvest these credentials and use them to authenticate to proxy servers, potentially gaining unauthorized access to internal network resources or services protected by those proxies. The confidentiality impact is rated High, with no integrity or availability impact (Github Advisory, Feedly).

1. Identify a vulnerable Airflow instance: Confirm the target is running Apache Airflow before version 3.1.6 (Airflow 3.x) or before 2.11.1 (Airflow 2.x) with Connections configured to use proxy URLs containing embedded credentials.
2. Obtain log access: Gain access to Airflow task logs — this may require valid Airflow user credentials with at least viewer-level permissions, or access to the underlying log storage (e.g., S3 bucket, GCS bucket, or local filesystem where logs are stored).
3. Identify relevant task logs: Browse or search task logs for entries where Connections with proxy configurations are rendered, such as during task initialization or when connection details are printed for debugging.
4. Extract proxy credentials: Locate log lines containing proxy URLs in the format http://username:password@proxy-host:port or similar, which appear unmasked due to the missing sensitive field designation.
5. Leverage credentials: Use the extracted proxy credentials to authenticate to the proxy server and access internal resources or services that the proxy protects (Openwall OSS-Sec, Github Advisory).

• Logs: Airflow task logs containing proxy URLs with embedded credentials in plaintext (e.g., patterns matching http(s)://[user]:[password]@[host]:[port]) in log files or log storage backends (S3, GCS, local filesystem).
• Logs: Unexpected or unauthorized access to Airflow task log storage (e.g., unusual API calls to S3/GCS log buckets from unfamiliar IP addresses).
• Network: Proxy authentication attempts using credentials that match those stored in Airflow Connections, originating from unexpected source IPs or at unusual times.
• Logs: Airflow audit logs showing unusual log access patterns, such as bulk log downloads or access by users who do not normally view task logs.

Users should upgrade to Apache Airflow 3.1.6 or later (for Airflow 3.x) or 2.11.1 or later (for Airflow 2.x), which marks proxy-related Connection fields as sensitive and ensures they are automatically masked in log output. As an interim measure, organizations should audit existing task logs from affected versions to identify any instances where proxy credentials may have been exposed, and rotate any compromised proxy credentials immediately. Implementing strict access controls on Airflow log storage (e.g., restricting S3/GCS bucket access) can reduce the risk of credential exposure until patching is complete (Github Advisory, Apache Mailing List).

The vulnerability received coverage from cybersecurity news outlets including CyberSecurityNews and IT Security News, which highlighted the risk of sensitive data exposure in Apache Airflow workflows. The Hacker News weekly recap also mentioned the issue alongside other critical CVEs. Community discussion on platforms such as Infosec.exchange and Bluesky noted the practical risk to organizations using proxy-authenticated connections in Airflow. The Apache Software Foundation rated the severity as "low" in the original OSS-Security disclosure, though CISA-ADP assigned a CVSS score of 7.5 (High) (Openwall OSS-Sec, Github Advisory).