CVE-2024-50378 — Sensitive Info Insertion into Sent Data in Software Foundation Apache Airflow
Severity
4.9MEDIUMNVD
EPSS
0.4%
top 41.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 8
Latest updateFeb 24
Description
Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users who previousl…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6
Affected Packages2 packages
Patches
🔴Vulnerability Details
4CVEList▶
Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli↗2024-11-08