CVE-2024-50378

Advisory

Affected versions of Apache Airflow are vulnerable to Exposure of Sensitive Information (CWE-201). This vulnerability allows authenticated users with audit log access to view sensitive configuration variables in task logs by setting them via the CLI. The attack vector involves executing CLI commands that store sensitive variables unencrypted in audit logs within cli.py, enabling unauthorized access to critical data. To mitigate, upgrade to Airflow version which masks secrets in task logs, preventing the exposure of sensitive configuration data. Additionally, users should manually delete any previously logged secret variables from the log table.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/apache/airflow/pull/43123
• https://github.com/advisories/GHSA-j857-2pwm-jjmm
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50378