CVE-2023-40712

Advisory

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts
• https://github.com/apache/airflow/pull/33512
• https://nvd.nist.gov/vuln/detail/CVE-2023-40712
• https://github.com/apache/airflow/pull/33516
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40712