PT-2024-3091

Name of the Vulnerable Software and Affected Versions Airflow versions 2.7.0 through 2.8.4 Description The issue is related to insufficient protection of internal data, allowing an authenticated user to access sensitive provider configuration via the "configuration" UI page when the...

GHSA-FPXX-XV4C-GXQP Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the exposeconfig option is set to non-sensitive-only. The exposeconfig option is False by default. It is recommended to upgrade to a...