CVE-2026-25219Disclosure(apache / airflow)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data. If you used Azure Service Bus connection with those values set or if you have other connections with those values storing sensitve values, you should upgrade Airflow to 3.1.8

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

airflow

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-04-15); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

apache

Products

airflow

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-15	2	Disclosure2
2026-04-16	1	Disclosure1

Full discourse3 posts

Open Source Security mailing list@oss_security175d
Disclosure
CVE-2025-54550: Apache Airflow: RCE by race condition in example_xcom dag https://www.openwall.com/lists/oss-security/2026/04/15/1 CVE-2026-25219: Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access https://www.openwall.com/lists/oss-security/2026/04/15/3
Post summary
The note announces two newly disclosed CVEs for Apache Airflow: CVE‑2025‑54550 is an RCE caused by a race condition in the example_xcom DAG, and CVE‑2026‑25219 exposes sensitive Azure Service Bus connection strings to users with view access.
10000310
4.4K followersView on X
CVE@CVEnew175d
Disclosure
CVE-2026-25219 The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could s… https://www.cve.org/CVERecord?id=CVE-2026-25219
Post summary
The CVE-2026-25219 vulnerability involves unmasked `access_key` and `connection_string` properties in a secrets masker, potentially exposing credentials to users with read access.
00000120
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds175d
Disclosure
CVE-2026-25219 Sensitive Data Exposure in Airflow Connection Properties for Azure Service Bus https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25219
Post summary
The post announces CVE‑2026‑25219, describing a sensitive data exposure in Airflow’s Azure Service Bus connection properties, but offers no PoC, exploitation details, patches, or evidence of active exploitation.
0000042
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	airflow	-	-	-

Explore more

Back to dashboard apache CVEs airflow vulnerabilities

What researchers are saying

CVE-2026-25219

Open Source Security mailing list@oss_securityDisclosure

The note announces two newly disclosed CVEs for Apache Airflow: CVE‑2025‑54550 is an RCE caused by a race condition in the example_xcom DAG, and CVE‑2026‑25219 exposes sensitive Azure Service Bus connection strings to users with view access.

CVE@CVEnewDisclosure

The CVE-2026-25219 vulnerability involves unmasked `access_key` and `connection_string` properties in a secrets masker, potentially exposing credentials to users with read access.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE‑2026‑25219, describing a sensitive data exposure in Airflow’s Azure Service Bus connection properties, but offers no PoC, exploitation details, patches, or evidence of active exploitation.