CVE-2022-46651: Apache Airflow: Security vulnerability on AirFlow Connections
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
Apache Airflowto a version that resolves this vulnerability.Fixed in 2.6.3
Event History
Frequently Asked Questions
What is CVE-2022-46651?
CVE-2022-46651 is a vulnerability in Apache Airflow versions before 2.6.3 that allows an unauthorized actor to gain access to sensitive information in the Connection edit view.
What is the severity of CVE-2022-46651?
CVE-2022-46651 has a severity rating of 6.5 (medium).
How does CVE-2022-46651 affect Apache Airflow?
CVE-2022-46651 affects Apache Airflow versions before 2.6.3 by exposing sensitive information in the Connection edit view.
How can I fix CVE-2022-46651?
To fix CVE-2022-46651, update your Apache Airflow installation to version 2.6.3 or higher.
Where can I find more information about CVE-2022-46651?
You can find more information about CVE-2022-46651 on the following references: [GitHub](https://github.com/apache/airflow/pull/32309), [Apache Mailing List](https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-46651).