PUBLISHED
2026-04-15 13:16
MODIFIED
2026-04-15 14:16
EPSS (Prob. Exploit)
0.55%
Top 54.6%
> DESCRIPTION
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data.
If you used Azure Service Bus connection with those values set or if you have other connections with those values storing sensitve values, you should upgrade Airflow to 3.1.8
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
> GITHUB SECURITY ADVISORY
GHSA-4g48-54q2-fg7q
MODERATE
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
AFFECTED PACKAGES:
PIP / apache-airflow
< 3.1.8
Fixed in: 3.1.8
> HISTORIQUE DES MODIFICATIONS
Première apparition
15/04/2026 13:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Total des modifications: 1
Dernière mise à jour: 6 months ago