PT-2024-3091 · Airflow · Airflow

Name of the Vulnerable Software and Affected Versions: Airflow versions 2.7.0 through 2.8.4 Description: The issue is related to insufficient protection of internal data, allowing an authenticated user to access sensitive provider configuration via the "configuration" UI page when the...

GHSA-FPXX-XV4C-GXQP Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the exposeconfig option is set to non-sensitive-only. The exposeconfig option is False by default. It is recommended to upgrade to a...