https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:36:57 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-12604 bdu:2025-12604 https://cve.radiocsirt.org/vuln/bdu:2025-12604 https://cve.radiocsirt.org/vuln/bit-airflow-2025-54831 <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> https://cve.radiocsirt.org/vuln/bit-airflow-2025-54831 https://cve.radiocsirt.org/vuln/euvd-2026-260030 EUVD-2026-260030 https://cve.radiocsirt.org/vuln/euvd-2026-260030 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54831 <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54831 https://cve.radiocsirt.org/vuln/ghsa-q475-2pgm-7hvp <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> https://cve.radiocsirt.org/vuln/ghsa-q475-2pgm-7hvp https://cve.radiocsirt.org/vuln/pysec-2025-85 <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a &#34;write-only&#34; model for sensitive values.</p> <p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.</p> <p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p> <p>Users of Airflow 3.0.3 are advised to upgrade Airflow to &gt;=3.0.4.</p> https://cve.radiocsirt.org/vuln/pysec-2025-85