Is CVE-2025-54831 actively exploited?

No active exploitation of CVE-2025-54831 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-54831 be exploited remotely?

Yes. CVE-2025-54831 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-54831?

CVE-2025-54831 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2025-54831

MEDIUM

CVE-2025-54831

CWE-213Published: September 26, 2025· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.

In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.

This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.

Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.

NVD Source

Technical Analysis

CVE-2025-54831 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.