CVE-2024-45784

Advisory

Apache Airflow affected versions have a vulnerability that can expose sensitive configuration variables in task logs. This allows DAG authors to unintentionally or intentionally log such variables, enabling unauthorized users to access critical data and potentially compromising Airflow deployments. Secrets are now masked in task logs to prevent this exposure. Additionally, if secret values might have been logged and logs aren't protected, it is recommended to update those secrets.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-46c3-5xc5-wwhv
• https://github.com/apache/airflow/pull/43335
• https://github.com/apache/airflow/commit/0a9c3c007bf1672398a63bb9c97b82ec48f60afc
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45784