{"id":"CVE-2025-68438","aliases":["BIT-airflow-2025-68438","EUVD-2026-2913","GHSA-3qmm-r55x-hpxx","PYSEC-2026-9"],"status":"published","title":"Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00616,"percentile":0.49849,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-01-16T10:06:08Z","modified":"2026-11-04T02:30:43Z","fixes":[{"ecosystem":"PyPI","package":"apache-airflow","fixed_in":["3.1.6"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"airflow","fixed_in":["3.1.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"airflow","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.1.6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.6"}]}],"versions":["3.1.0","3.1.1","3.1.1rc1","3.1.1rc2","3.1.2","3.1.2rc1","3.1.2rc2","3.1.3","3.1.3rc1","3.1.4","3.1.4rc1","3.1.4rc2","3.1.5","3.1.5rc1","3.1.6rc1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.6"}]}],"versions":["3.1.0","3.1.1","3.1.1rc1","3.1.1rc2","3.1.2","3.1.2rc1","3.1.2rc2","3.1.3","3.1.3rc1","3.1.4","3.1.4rc1","3.1.4rc2","3.1.5","3.1.5rc1","3.1.6rc1"]}],"products":[{"vendor":"apache","product":"airflow"},{"vendor":"apache software foundation","product":"apache airflow"}],"references":[{"url":"https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/15/5","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68438","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-9.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3qmm-r55x-hpxx","tags":["advisory"]},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68438.json","tags":["advisory"]},{"url":"https://github.com/apache/airflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-68438","title":"Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-16T10:06:08.128Z","modified":"2026-11-03T06:51:50.923Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-03T07:42:18.253008Z"}],"euvd":[{"id":"EUVD-2026-2913","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-16T10:06:08Z","modified":"2026-11-03T06:51:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:50:00.381029Z"}],"ghsa":[{"id":"GHSA-3qmm-r55x-hpxx","title":"Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-16T12:30:25Z","modified":"2026-06-05T14:25:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2025-68438","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-16T11:16:03.76Z","modified":"2026-11-03T07:18:02.463Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-03T11:52:38.53866Z"}],"osv":[{"id":"CVE-2025-68438","title":"Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-16T10:06:08.128Z","modified":"2026-11-04T02:30:43.974260996Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"GHSA-3qmm-r55x-hpxx","title":"Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-16T12:30:25Z","modified":"2026-09-10T03:50:58.819445976Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"PYSEC-2026-9","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-16T11:16:03.76Z","modified":"2026-06-10T17:00:29.974499745Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"BIT-airflow-2025-68438","title":"Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated","description":"In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue","status":"published","published":"2026-01-21T08:39:22.633Z","modified":"2026-09-08T08:45:25.36538241Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}