Apache Airflow Information Disclosure Vulnerability (CNVD-2023-85609)

Apache Airflow is the United States Apache (Apache) Foundation’s set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions 2.4.0 to 2.7.0 information leakage vulnerability , the vulnerability stems from sensitive configuration information to the authenticated user public , even in the hide_config option is set to only non-sensitive , but also able to read the configuration through the Airflow REST API to configure , an attacker can use the vulnerability to obtain sensitive information .