The vulnerability permits secrets from the Airflow configuration file to be logged in plain text within DAG run logs shown in the Airflow web UI. An attacker who can view these logs could recover sensitive credentials, potentially enabling further compromise of the underlying infrastructure. This causes a confidentiality breach of configuration data and is categorized as CWE‑532. Based on the description, it is inferred that any user with permission to view DAG run logs can see the secrets; the specific attack vector is not explicitly stated but log access appears to be the primary path.

Apache Airflow from the Apache Software Foundation is affected. All releases earlier than version 3.2.0 are impacted because the fix was introduced in that release; no later sub‑versions are mentioned.

The CVSS score is 7.5, indicating a high severity. EPSS is < 1%, suggesting a low probability of widespread exploitation, and the vulnerability is not listed in CISA KEV. The exposure of credentials remains a serious confidentiality breach. The likely exploitation path is through authorized UI access to DAG run logs, inferred from log exposure in the UI. No public exploits are known, but logged secrets could be leveraged once an adversary gains or cannot restrict log visibility.