Apache Airflow: Sensitive configuration values are not masked in the logs by default

🗓️ 07 Jul 2026 14:34:44Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 5 Views

Airflow before 2.10.3 may log sensitive configuration; upgrade to 2.10.3 or later to mask secrets.

Reporter	Title	Published	Views	Family All 22
BDU FSTEC	The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the fact that it exposes information in debugging messages, allowing attackers to gain unauthorized access to protected information.	9 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-45784	15 Nov 202408:27	–	circl
CNNVD	Apache Airflow 安全漏洞	15 Nov 202400:00	–	cnnvd
CVE	CVE-2024-45784	15 Nov 202408:20	–	cve
Cvelist	CVE-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default	15 Nov 202408:20	–	cvelist
Github Security Blog	Apache Airflow: Sensitive configuration values are not masked in the logs by default	15 Nov 202409:32	–	github
Hacker One	Internet Bug Bounty: Apache Airflow: Sensitive Information Exposure in DAG Run Logs	7 Nov 202408:50	–	hackerone
NVD	CVE-2024-45784	15 Nov 202409:15	–	nvd
OSV	BIT-AIRFLOW-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default	19 Nov 202407:07	–	osv
OSV	CVE-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default	15 Nov 202408:20	–	osv

Vulners

Node

pypi airflowRange0–2.10.3

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45784
github	www.github.com/apache/airflow/pull/43040
github	www.github.com/apache/airflow
github	www.github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-182.yaml
lists	www.lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h
openwall	www.openwall.com/lists/oss-security/2024/11/15/1
pypi	www.pypi.org/project/airflow
github	www.github.com/advisories/GHSA-46c3-5xc5-wwhv

07 Jul 2026 17:23Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.01295

SSVC