Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-mjqh-v5f2-g2mw: Apache Airflow information exposure vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.

Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.

ghsa
#vulnerability#apache#git#auth

Apache Airflow information exposure vulnerability

Moderate severity GitHub Reviewed Published Sep 12, 2023 to the GitHub Advisory Database • Updated Sep 12, 2023

Related news

CVE-2023-40712: Stop adding values to rendered templates UI when there is no dagrun by hussein-awala · Pull Request #33516 · apache/airflow

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.