Critical Security Vulnerability Discovered in Apache Airflow 3.0.3
A significant security vulnerability has surfaced in Apache Airflow version 3.0.3, breaching the confidentiality of sensitive connection details, which are accessible to users with merely read permissions.
Designated as CVE-2025-54831, this flaw has been classified as of “important” severity. It critically undermines the platform’s foundational security framework intended for safeguarding sensitive data within workflow connections.
The introduction of Apache Airflow 3.0 heralded substantial modifications in the management of sensitive information, adopting a “write-only” paradigm aimed at restricting access to sensitive connection fields solely to Connection Editing Users.
This enhancement was conceived to thwart unauthorized access to pivotal authentication credentials, database access keys, and API tokens ostensibly stored within Airflow connections.
Nevertheless, the implementation in version 3.0.3 exhibited a fundamental defect, effectively reversing these security enhancements.
This vulnerability permits users endowed with standard READ permissions to fetch sensitive connection details through both the Airflow API and the web user interface.
Alarmingly, this exposure transpires irrespective of the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS configuration setting, which was specifically devised to obscure sensitive connection details from unwarranted users.
This breach consequently renders the security configuration ineffectual, posing a tangible risk to organizations that place their trust in Airflow’s access control mechanisms.
Apache’s security analysts uncovered the vulnerability after identifying unexpected anomalies in connection handling protocols.
The flaw is particularly pertinent to Apache Airflow version 3.0.3, with earlier 2.x versions remaining unscathed, as they adhere to distinct connection management protocols where the exposure of sensitive data to connection editors was a documented feature.
Analysis of Connection Access Control Mechanism
This vulnerability arises from a flawed execution of the connection access control system implemented in Airflow 3.0.
When users with READ permissions invoke queries for connection information via the /api/v1/connections/{connection_id} endpoint or access the connection interface through the web UI, the system erroneously exposes sensitive fields, including passwords, tokens, and connection strings that ought to remain concealed.
{
"connection_id": "postgres_default",
"conn_type": "postgres",
"host": "localhost",
"login": "airflow",
"password": "exposed_sensitive_data",
"schema": "airflow",
"port": 5432
}Organizations utilizing Apache Airflow 3.0.3 should promptly update to version 3.0.4 or later to rectify this security vulnerability and reinstate proper access controls for sensitive connection information.
Source link: Cybersecuritynews.com.
