diff --git a/.nextchanges/cli/auth-describe-config-profile-env.md b/.nextchanges/cli/auth-describe-config-profile-env.md
new file mode 100644
index 00000000000..4ef0d12dd8e
--- /dev/null
+++ b/.nextchanges/cli/auth-describe-config-profile-env.md
@@ -0,0 +1 @@
+Fixed `databricks auth describe` misattributing a profile selected via `DATABRICKS_CONFIG_PROFILE` as `(from bundle)` when run inside a bundle root ([#5904](https://github.com/databricks/cli/pull/5904)).
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/.databrickscfg b/acceptance/cmd/auth/describe/bundle-profile-env/.databrickscfg
new file mode 100644
index 00000000000..cda36ac3800
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/.databrickscfg
@@ -0,0 +1,6 @@
+[DEFAULT]
+host = $DATABRICKS_HOST
+
+[env-profile]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/databricks.yml b/acceptance/cmd/auth/describe/bundle-profile-env/databricks.yml
new file mode 100644
index 00000000000..f64132cea83
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: test-auth
+
+workspace:
+  host: $DATABRICKS_HOST
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/out.test.toml b/acceptance/cmd/auth/describe/bundle-profile-env/out.test.toml
new file mode 100644
index 00000000000..f784a183258
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/out.test.toml
@@ -0,0 +1,3 @@
+Local = true
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/output.txt b/acceptance/cmd/auth/describe/bundle-profile-env/output.txt
new file mode 100644
index 00000000000..38d278a905d
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/output.txt
@@ -0,0 +1,21 @@
+
+=== Describe inside a bundle attributes the profile to DATABRICKS_CONFIG_PROFILE (#2303)
+
+>>> [CLI] auth describe
+Host: [DATABRICKS_URL]
+User: [USERNAME]
+Authenticated with: pat
+-----
+Current configuration:
+  ✓ host: [DATABRICKS_URL] (from bundle)
+  ✓ workspace_id: [NUMID]
+  ✓ token: ******** (from .databrickscfg config file)
+  ✓ profile: env-profile (from DATABRICKS_CONFIG_PROFILE environment variable)
+  ✓ config_file: .databrickscfg (from DATABRICKS_CONFIG_FILE environment variable)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: pat
+  ✓ http_timeout_seconds: 90 (from bundle)
+  ✓ rate_limit: [NUMID] (from DATABRICKS_RATE_LIMIT environment variable)
+  ✓ retry_timeout_seconds: 900 (from bundle)
+  ✓ cloud: AWS
+  ✓ discovery_url: [DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/script b/acceptance/cmd/auth/describe/bundle-profile-env/script
new file mode 100644
index 00000000000..33dc4391829
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/script
@@ -0,0 +1,15 @@
+# Bake the harness host into the bundle file and the profile config.
+envsubst < databricks.yml > out.yml && mv out.yml databricks.yml
+envsubst < .databrickscfg > out && mv out .databrickscfg
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+
+# Select the profile via the environment, not a flag or databricks.yml. Auth is
+# fully determined by the profile, so remove the ambient host/token.
+unset DATABRICKS_HOST DATABRICKS_TOKEN
+export DATABRICKS_CONFIG_PROFILE=env-profile
+
+# Inside a bundle root the resolved config labels every attribute "bundle", so
+# before #2303 the profile read "(from bundle)" even though it came from
+# DATABRICKS_CONFIG_PROFILE. describe must attribute it to the env var.
+title "Describe inside a bundle attributes the profile to DATABRICKS_CONFIG_PROFILE (#2303)\n"
+trace $CLI auth describe
diff --git a/cmd/auth/describe.go b/cmd/auth/describe.go
index 890838d3fcc..a58e964de27 100644
--- a/cmd/auth/describe.go
+++ b/cmd/auth/describe.go
@@ -327,9 +327,21 @@ func getAuthDetails(cmd *cobra.Command, cfg *config.Config, showSensitive bool)
 	}
 	details := cfg.GetAuthDetails(opts...)
 
+	ctx := cmd.Context()
 	for k, v := range details.Configuration {
-		if k == "profile" && cmd.Flag("profile").Changed {
-			v.Source = config.Source{Type: config.SourceType("flag"), Name: "--profile"}
+		if k == "profile" {
+			// Profile-source precedence mirrors cmd/root/bundle.go:getProfile:
+			// an explicit --profile flag wins, then DATABRICKS_CONFIG_PROFILE.
+			// Inside a bundle root the resolved config labels every attribute
+			// "bundle" (bundle/config/workspace.go), which misattributes a
+			// profile that actually came from the environment (#2303). The
+			// value guard relabels only when the env var is the profile that
+			// won, so a profile set in databricks.yml still reads "bundle".
+			if cmd.Flag("profile").Changed {
+				v.Source = config.Source{Type: config.SourceType("flag"), Name: "--profile"}
+			} else if envProfile := env.Get(ctx, "DATABRICKS_CONFIG_PROFILE"); envProfile != "" && envProfile == v.Value {
+				v.Source = config.Source{Type: config.SourceEnv, Name: "DATABRICKS_CONFIG_PROFILE"}
+			}
 		}
 
 		if k == "host" && cmd.Flag("host").Changed {