⚠️ 보안 공지: CVE-2025-54831(Apache Airflow3.0.3)

choo121600 · 9월 25, 2025, 5:03오후

7월 말쯤 오픈 톡방에서 공유드렸던 Apache Airflow 3.0.3의 Connection 민감 필드 정보 노출 취약점에 대해, 오늘 공식 안내글(CVE-2025-54831)이 올라왔습니다.

관련 이슈 및 패치:

github.com/apache/airflow

Connection passwords visible in UI

열림 11:19AM - 25 Jul 25 UTC

닫힘 12:13PM - 31 Jul 25 UTC

LukePaytec

kind:bug priority:critical area:core area:UI affected_version:3.0

### Apache Airflow version 3.0.3 ### If "Other Airflow 2 version" selected, wh…ich one? _No response_ ### What happened? In airflow 3.0.2 the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` is set to True and you are not allowed to see passwords, secrets ect, as they are hidden with `***`. However when updating to airflow 3.0.3 the connections are accessible through the UI. ### What you think should happen instead? I would keep the passwords hashed and hidden from the UI. Seen in this image it should be like: <img width="861" height="373" alt="Image" src="https://github.com/user-attachments/assets/ede6e247-6117-485f-bff1-3d94c7833077" /> and not like this where someone can go grab it <img width="861" height="449" alt="Image" src="https://github.com/user-attachments/assets/ec99421d-8d7c-41bf-9555-2d0962de1345" /> ### How to reproduce Make sure that you have airflow 3.0.2 installed and go make a connection. You will see the passwords are not filtered and show raw on the frontend UI. ### Operating System We tried on linux x64 and on arm64 ### Versions of Apache Airflow Providers ``` apache-airflow-providers-amazon==9.9.0 apache-airflow-providers-celery==3.12.1 apache-airflow-providers-cncf-kubernetes==10.6.1 apache-airflow-providers-common-compat==1.7.2 apache-airflow-providers-common-io==1.6.1 apache-airflow-providers-common-messaging==1.0.4 apache-airflow-providers-common-sql==1.27.3 apache-airflow-providers-docker==4.4.1 apache-airflow-providers-elasticsearch==6.3.1 apache-airflow-providers-fab==2.3.0 apache-airflow-providers-ftp==3.13.1 apache-airflow-providers-git==0.0.4 apache-airflow-providers-google==16.1.0 apache-airflow-providers-grpc==3.8.1 apache-airflow-providers-hashicorp==4.3.1 apache-airflow-providers-http==5.3.2 apache-airflow-providers-microsoft-azure==12.5.0 apache-airflow-providers-mysql==6.3.2 apache-airflow-providers-odbc==4.10.1 apache-airflow-providers-openlineage==2.5.0 apache-airflow-providers-postgres==6.2.1 apache-airflow-providers-redis==4.1.1 apache-airflow-providers-sendgrid==4.1.2 apache-airflow-providers-sftp==5.3.2 apache-airflow-providers-slack==9.1.2 apache-airflow-providers-smtp==2.1.1 apache-airflow-providers-snowflake==6.5.0 apache-airflow-providers-ssh==4.1.1 apache-airflow-providers-standard==1.4.1 ``` ### Deployment Official Apache Airflow Helm Chart ### Deployment details Using k8s we deployed using the helm chart on the arm64 machine and used argo to deploy on the linux machine. ### Anything else? This bug happens every time and I suspect its not a big issue which can be resolved for next release. ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

github.com/apache/airflow

Handle unmodified sensitived fields when updating connections

main ← astronomer:fix-52301

열림 05:39PM - 30 Jul 25 UTC

pierrejeambrun

+478 -3

closes: https://github.com/apache/airflow/issues/52301 closes: https://github.c…om/apache/airflow/issues/53753 How it works: For connection, 'password' and 'extras' are merged with their original value when doing an update. The function works similarly to the `redact` function, it will recursively handle all sort of data types and detect sensitive values that were not modified in the 'new_value' and then restore the value from the unredacted previous value. See the warning note: <img width="957" height="670" alt="Screenshot 2025-07-30 at 19 34 42" src="https://github.com/user-attachments/assets/47415058-7ec6-47c5-a57e-e8213433036c" /> <img width="933" height="801" alt="Screenshot 2025-07-30 at 19 34 48" src="https://github.com/user-attachments/assets/9e503490-b243-4cad-b888-71134e561532" /> After adding a key 'new_key' to the extra and saving this is what we get in the UI: <img width="1055" height="845" alt="Screenshot 2025-07-30 at 19 35 44" src="https://github.com/user-attachments/assets/57a092e4-b154-46b2-9187-b599e80bfda1" /> And from the CLI we can see that both password, and extra redacted field were preserved: <img width="1886" height="186" alt="Screenshot 2025-07-30 at 19 36 10" src="https://github.com/user-attachments/assets/70df3ba2-039f-4f5d-99ca-fa25cafe3ffb" /> The only downside is that we cannot 'insert' a real '\*\*\*' for redacted value because this is how we detect that the value didn't change. I think it's a fair limitation, '\*\*\*' shouldn't never be a valid value for a sensitive field anyway. @ashb is working on a follow up PR to instead use unicode characters that looks like '\*\*\*' but are not, to make it even less likely that it will be blocking for users. (They would have to chose a very weird value for their secret). Another example, it also handle well arrays: <img width="1102" height="721" alt="Screenshot 2025-07-30 at 19 38 58" src="https://github.com/user-attachments/assets/becdd7e1-ef62-4ce1-8f3e-fc477bf17e7d" /> <img width="1077" height="914" alt="Screenshot 2025-07-30 at 19 39 14" src="https://github.com/user-attachments/assets/1717a557-bbd3-4b63-90bc-db8acd249777" /> password1 and password3 value in the array are retained. <img width="1896" height="240" alt="Screenshot 2025-07-30 at 19 39 31" src="https://github.com/user-attachments/assets/ecb406ac-4af9-4f2c-97ca-27ca0f80c9a0" />

취약점 개요

제목: CVE-2025-54831: Apache Airflow: Connection sensitive details exposed to users with READ permissions (읽기 권한이 있는 사용자에게 Connection 관련 민감 정보가 노출됨)
심각도(Severity): Important
영향받는 버전: Apache Airflow 3.0.3

Apache Airflow 3에서는 Connection의 민감 필드 정보(비밀번호, 토큰 등)를 수정 권한이 있는 사용자만 작성 가능하도록(write-only) 제한하는 모델을 도입했습니다.

그러나 3.0.3에서는 이 모델이 무너져, READ 권한만 가진 사용자도 API와 UI를 통해 민감 정보를 확인할 수 있는 문제가 발생했습니다.

또한 이 동작은 AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS 설정값도 무시한다는 큰 문제가 있었습니다.

Airflow 2.x 버전은 영향을 받지 않습니다. 2.x에서는 Connection에서 민감 정보를 볼 수 있는 것이 의도된 동작입니다.

권장 조치

Apache Airflow 3.0.3 사용자 분들은 반드시 3.0.4 이상으로 업그레이드를 권장합니다.
3.0.3 버전을 유지할 경우 심각한 보안 위험이 발생할 수 있습니다.

References:

https://lists.apache.org/thread/jg3jo9lx397f71ojbcy9kd60vm3gpn0n
https://www.cve.org/CVERecord?id=CVE-2025-54831