---
id: CVE-2025-68438
aliases:
  - GHSA-3qmm-r55x-hpxx
  - BIT-airflow-2025-68438
  - PYSEC-2026-9
title: >-
  Apache Airflow secrets in rendered templates could contain parts of sensitive
  values when truncated
summary: >-
  Apache Airflow secrets in rendered templates could contain parts of sensitive
  values when truncated
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: apache-airflow
product: apache-airflow
ecosystem: pip
affected:
  - 'apache-airflow >= 3.1.0, < 3.1.6'
patched:
  - apache-airflow 3.1.6
published: '2026-01-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:58.819445976Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3qmm-r55x-hpxx'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68438'
  - url: 'https://github.com/apache/airflow'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-9.yaml
  - url: 'https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff'
  - url: 'http://www.openwall.com/lists/oss-security/2026/01/15/5'
tags:
  - osv
  - pip
epss: 0.00655
epssPercentile: 0.49251
ingestedAt: '2026-09-12T03:13:01.647Z'
---

## Overview

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.

Users are recommended to upgrade to 3.1.6 or later, which fixes this issue

## Affected packages

- `apache-airflow >= 3.1.0, < 3.1.6`

## Remediation

Upgrade to a patched release:

- `apache-airflow 3.1.6`