PUBLISHED
2026-02-24 10:16
MODIFIED
2026-02-24 10:16
EPSS (Prob. Exploit)
0.42%
Top 63.6%
> DESCRIPTION
Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. Users who previously used the CLI to set connections should manually delete entries with those connection sensitive values from the log table. This is similar but not the same issue as CVE-2024-50378
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-201: Insertion of Sensitive Information Into Sent Data - The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
> GITHUB SECURITY ADVISORY
GHSA-8r55-rv5w-6pfm
MODERATE
Apache Airflow exposes sensitive information in its log files
AFFECTED PACKAGES:
PIP / apache-airflow
< 2.11.1
Fixed in: 2.11.1
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli
AFFECTED PACKAGES:
Unknown / Unknown
9281 versions affected
ALIASES:
BIT-airflow-2025-27555, GHSA-8r55-rv5w-6pfm, PYSEC-2026-2347
> HISTORIQUE DES MODIFICATIONS
Première apparition
24/02/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/03/2026 06:46
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-201: Insertion of Sensitive Information Into Sent Data - The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that ac...
Total des modifications: 1
Dernière mise à jour: 8 months ago