An authenticated low-privilege user who has read access to the event-log or audit API can exploit it. The user does not need prior access to the affected Connection or Variable.
Connection and Variable secret values recorded in affected audit-log rows may be recoverable verbatim from the Log.extra column. This can include credentials associated with those Connections or Variables.
The issue affects Apache Airflow versions before 3.4.0 when audit logs contain Connection or Variable secret values and a user has access to the event-log or audit API. The provided information does not state whether such API access is granted by default.
Restrict low-privilege users' read access to the event-log and audit API, particularly access to audit rows involving Connections and Variables. Existing audit-log data may contain cleartext secrets, so access to the Log.extra data should also be limited.
Check whether it runs Apache Airflow before 3.4.0 and review audit-log records for Connection or Variable changes whose Log.extra values contain secret material in cleartext. Also identify users with read access to the event-log or audit API.