CVE-2023-40712: Apache Airflow: Secrets can be unmasked in the "Rendered Template"
First published: Tue Sep 12 2023(Updated: )
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow | <2.7.1 | |
| pip/apache-airflow | >=0<2.7.1 | 2.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-40712
- https://github.com/apache/airflow/pull/33512
- https://github.com/apache/airflow/pull/33516
- https://github.com/apache/airflow/commit/4390524a41fdfd2d57f1d2dc98ad7b4009c8399e
- https://github.com/apache/airflow/commit/d9814eb3a2fc1dbbb885a0a2c1b7a23ce1cfa148
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-171.yaml
- https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts
- https://github.com/advisories/GHSA-mjqh-v5f2-g2mw (Advisory)
Frequently Asked Questions
What is CVE-2023-40712?
CVE-2023-40712 is a vulnerability in Apache Airflow that allows authenticated users to unmask secret configuration in the UI.
Which versions of Apache Airflow are affected by CVE-2023-40712?
Versions before 2.7.1 of Apache Airflow are affected by CVE-2023-40712.
How can an authenticated user exploit CVE-2023-40712?
An authenticated user who has access to see the task/dag in the UI can craft a URL to unmask the secret configuration.
What is the severity of CVE-2023-40712?
CVE-2023-40712 has a severity rating of 6.5 (medium).
How can I fix CVE-2023-40712?
To fix CVE-2023-40712, upgrade to Apache Airflow version 2.7.1 or higher.
- collector/oss-sec
- alias/CVE-2023-40712
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-mjqh-v5f2-g2mw
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/tags
- agent/event
- agent/weakness
- agent/title
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/apache
- canonical/apache airflow
- package-manager/pip