---
id: CVE-2025-54831
title: >-
  Apache Airflow 3 introduced a change to the handling of sensitive information
  in Connections
summary: >-
  Apache Airflow 3 introduced a change to the handling of sensitive information
  in Connections. The intent was to restrict access to sensitive connection
  fields to Connection Editing Users, effectively applying a "write-only" model
  for sen…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-213
vendor: apache
product: airflow
affected:
  - airflow = 3.0.3
published: '2025-09-26'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-54831'
references:
  - url: 'https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/25/4'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00914
epssPercentile: 0.58979
ingestedAt: '2026-10-12T14:50:34.005Z'
---

## Overview

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.


In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.


This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.






Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.

## Affected

- `airflow = 3.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.