BIT-airflow-2024-31869
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2024-31869.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-airflow-2024-31869
- Aliases
- Published
- 2024-04-20T07:16:43Z
- Modified
- 2026-09-10T16:01:02Z
- Summary
- Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
- Details
-
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.
- Database specific
{ "cpes": [ "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "cpe:2.3:a:apache:airflow:*:*:*:*:*:python:*:*" ], "severity": "Medium" }- References
Affected packages
Bitnami / airflow
Package
- Name
- airflow
- Purl
- pkg:bitnami/airflow
Severity
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator