CVE-2024-31869: Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.exposeconfig" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "exposeconfig" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31869?
CVE-2024-31869 has been classified as a medium severity vulnerability.
How do I fix CVE-2024-31869?
To fix CVE-2024-31869, upgrade your Apache Airflow version to 2.9.0 or later.
What does CVE-2024-31869 exploit?
CVE-2024-31869 allows an authenticated user to access sensitive provider configuration information through the configuration UI when exposed improperly.
Which versions of Apache Airflow are affected by CVE-2024-31869?
Apache Airflow versions 2.7.0 through 2.8.4 are affected by CVE-2024-31869.
Who is impacted by CVE-2024-31869?
Authenticated users of Apache Airflow who have access to the configuration UI may be impacted by CVE-2024-31869.