CVE-2025-54831: Apache Airflow Bug Exposes Sensitive Connection Passwords

Estimated reading time: 10 minutes

Key Takeaways:

  • Apache Airflow 3.0.3 has a vulnerability (**CVE-2025-54831**) exposing sensitive connection details.
  • Cisco IOS and IOS XE are affected by a zero-day SNMP vulnerability (**CVE-2025-20352**) under active exploitation.
  • Fortra GoAnywhere MFT has a critical remote command injection vulnerability (**CVE-2025-10035**).
  • Immediate patching and strong access control are crucial for mitigating these risks.

Table of Contents:

What is the Issue?

The vulnerability, **CVE-2025-54831**, stems from a flaw introduced in Apache Airflow 3.0.3 concerning the handling of sensitive information within Connections. The original intent was to restrict access to sensitive connection fields exclusively to Connection Editing Users, implementing a ‘write-only’ model for sensitive values. However, version 3.0.3 inadvertently broke this model, enabling users with READ permissions to view sensitive connection information through both the API and the UI. This behavior also bypassed the AIRFLOW\_\_CORE\_\_HIDE\_SENSITIVE\_VAR\_CONN\_FIELDS configuration option, which is designed to hide these fields.

Essentially, users with mere viewing rights could access passwords, tokens, and other sensitive credentials associated with Airflow’s connection configurations – data meant to be strictly confidential. This impacts breach detection capabilities, as unauthorized access to credentials can lead to undetected lateral movement within a network.

This flaw only affects Apache Airflow 3.0.3. Prior Airflow 2.x versions are not impacted.

Technical Implications

The exposure of sensitive connection information can have significant implications. Attackers can leverage these exposed credentials to gain unauthorized access to external systems and resources that Airflow connects to. This can lead to data breaches, system compromise, and other malicious activities.

The technical details of the vulnerability involve a breakdown in the intended access control mechanisms within Airflow. The ‘write-only’ model for sensitive connection fields was not correctly implemented in version 3.0.3, resulting in the bypass of access restrictions. This allows unauthorized users to view sensitive data that should have been protected.

Remediation Steps

The Apache Airflow team strongly advises all users of version 3.0.3 to upgrade immediately to a patched version. This is the most effective way to mitigate the risk posed by this vulnerability.

Other Actively Exploited Vulnerabilities

Cisco IOS and IOS XE SNMP Vulnerability (CVE-2025-20352)

Cisco has disclosed a critical zero-day vulnerability, identified as CVE-2025-20352, impacting all supported versions of Cisco IOS and IOS XE. This flaw, already under active exploitation, affects up to 2 million exposed devices globally. It is caused by a stack overflow bug in the SNMP (Simple Network Management Protocol) component, which handles network management data. The vulnerability has a CVSS severity score of 7.7. Exploitation can lead to denial-of-service (DoS) attacks or, in some instances, remote code execution (RCE) with root privileges. Cisco has confirmed that attackers exploited this vulnerability after compromising local administrator credentials.

To achieve RCE, an attacker needs access to a device’s SNMP read-only community string or valid SNMPv3 credentials. These strings are often shipped with default values and remain unchanged, making them an easy target. Once exploited, attackers can escalate privileges to root, bypassing administrative restrictions. Achieving root-level access on Cisco devices poses a severe breach, granting privileges beyond those of administrators.

For DoS attacks, an attacker only needs valid SNMP credentials to crash vulnerable devices remotely. This risk is exacerbated by the common practice of exposing SNMP services directly to the Internet. Shodan scans indicate that over 2 million Cisco devices have SNMP exposed, creating a significant attack surface.

Cisco has released software updates to address the issue and urges customers to upgrade immediately. For organizations unable to patch immediately, Cisco recommends restricting SNMP access to trusted users and monitoring devices using SNMP commands to detect anomalies. Cisco has stated that there are no workarounds available, emphasizing patching as the most effective defense.

Remediation for CVE-2025-20352:

  • Upgrade immediately to the fixed versions of Cisco IOS and IOS XE.
  • Restrict SNMP access to trusted users and secure internal networks.
  • Block SNMP exposure to the Internet, ensuring SNMP is only accessible through secured management networks.
  • Replace or randomize default SNMP community strings, avoiding commonly known or weak credentials.
  • Enforce SNMPv3 with strong authentication and encryption.
  • Monitor SNMP activity using the snmp command and logging tools.
  • Review and rotate local administrator credentials.
  • Harden device configurations by disabling unnecessary services and applying Cisco’s security best practices.

Fortra GoAnywhere MFT Vulnerability (CVE-2025-10035)

A maximum severity vulnerability, CVE-2025-10035, exists in Fortra’s GoAnywhere MFT, allowing remote command injection without authentication. The vendor disclosed the flaw on September 18, but learned about it a week earlier.

CVE-2025-10035 is a deserialization vulnerability in the License Servlet of the GoAnywhere managed file transfer software. It can be exploited to inject commands by an actor with a validly forged license response signature.

WatchTowr Labs reported credible evidence of in-the-wild exploitation of Fortra GoAnywhere CVE-2025-10035 dating back to September 10, eight days before Fortra’s public advisory.

Exploitation steps include:

  1. Achieving remote command execution after exploiting the pre-auth deserialization vulnerability.
  2. Creating a backdoor admin account called \_admin-go\_.
  3. Using the account to create a web user that enabled “legitimate” access.
  4. Uploading and executing multiple secondary payloads.

The payloads are named ‘\_zato\_be.exe\_’ and ‘\_jwunst.exe\_.’ The latter is a legitimate binary for the remote access product SimpleHelp, abused for persistent hands-on control of the compromised endpoints.

Attackers also executed the ‘whoami/groups’ command, saving the output to a text file (test.txt) for exfiltration to check the privileges of the compromised account and explore lateral movement opportunities.

Remediation for CVE-2025-10035:

  • Upgrade to a patched version, either 7.8.4 (latest) or 7.6.3 (Sustain Release).
  • Remove public internet exposure for the GoAnywhere Admin Console.
  • Inspect log files for errors containing the string ‘SignedObject.getObject’ to determine if an instance has been impacted.

Practical Takeaways and Actionable Advice

For Technical Readers:

  • Patching is Paramount: Apply patches as soon as they are released. Prioritize patching for actively exploited vulnerabilities like CVE-2025-20352 and CVE-2025-10035.
  • Access Control Hardening: Implement strict access control policies, especially for sensitive systems like Apache Airflow. Use the principle of least privilege to limit user access to only what is necessary.
  • Network Segmentation: Segment your network to limit the impact of potential breaches. This can prevent attackers from moving laterally within the network and accessing sensitive resources.
  • Monitor Logs: Regularly monitor system and application logs for suspicious activity. Implement automated alerting to detect anomalies and potential security incidents. This ties into real-time ransomware intelligence, as unusual activity can be an early indicator of compromise.
  • SNMP Hardening: For Cisco devices, harden SNMP configurations by restricting access, randomizing community strings, and enforcing SNMPv3 with strong authentication.
  • Credential Management: Review and rotate local administrator credentials regularly. Avoid using default credentials and enforce strong password policies.

For Non-Technical Readers:

  • Understand Your Risks: Be aware of the potential risks associated with vulnerabilities in your systems and applications. Stay informed about the latest security threats and vulnerabilities.
  • Prioritize Security: Make security a priority in your organization. Ensure that security policies and procedures are in place and that employees are trained on security best practices.
  • Invest in Security Tools: Invest in security tools and technologies that can help you protect your organization from cyber threats. This includes firewalls, intrusion detection systems, and vulnerability scanners.
  • Regular Security Assessments: Conduct regular security assessments and penetration testing to identify vulnerabilities in your systems and applications.
  • Incident Response Plan: Develop and maintain an incident response plan to ensure that you can effectively respond to security incidents. This plan should outline the steps to take in the event of a breach, including containment, eradication, and recovery.
  • Supply Chain Risk Monitoring: Understand the risks associated with your supply chain and take steps to mitigate those risks. This includes assessing the security posture of your vendors and partners.

How PurpleOps Can Help

These recent vulnerabilities highlight the critical need for robust cyber threat intelligence platform and comprehensive security measures. PurpleOps offers a range of services designed to help organizations protect themselves from cyber threats, including:

  • Cyber Threat Intelligence: PurpleOps provides actionable cyber threat intelligence to help organizations stay ahead of emerging threats. Our intelligence feeds include information on the latest vulnerabilities, malware, and attack techniques.
  • Vulnerability Management: We offer vulnerability scanning and management services to help organizations identify and remediate vulnerabilities in their systems and applications.
  • Managed Security Services: PurpleOps provides 24/7 breach detection and response services to help organizations detect and respond to security incidents.
  • Dark Web Monitoring: Our dark web monitoring service can help organizations detect compromised credentials and other sensitive information that may be circulating on the dark web.
  • Real-Time Ransomware Intelligence: We provide real-time ransomware intelligence to help organizations protect themselves from ransomware attacks. Our intelligence feeds include information on the latest ransomware variants, attack techniques, and indicators of compromise.
  • Supply-Chain Risk Monitoring: The PurpleOps platform provides supply-chain risk monitoring to identify and mitigate potential risks associated with third-party vendors.
  • Underground Forum Intelligence: Our platform includes underground forum intelligence, offering insights into emerging threats and attacker tactics.
  • Brand Leak Alerting: We offer brand leak alerting to notify organizations of potential data breaches or brand-related security incidents.

By leveraging PurpleOps’ expertise, organizations can improve their security posture and reduce their risk of becoming victims of cyber attacks. Our solutions offer visibility into potential threats, enabling proactive defense and rapid response capabilities.

If you want to know more about how PurpleOps can protect your business, please visit PurpleOps Solutions or contact us at https://www.purple-ops.io/platform/ for more information.

FAQ

Q: What is CVE-2025-54831?

Q: What versions of Apache Airflow are affected by CVE-2025-54831?

Q: What is CVE-2025-20352?

Q: What is CVE-2025-10035?