CVE-2022-27949 json
Apache Airflow prior to 2.3.1 may include sensitive values in rendered template
published 2022-11-14 3 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2022-27949 , EUVD-2022-0016 , GHSA-fvw2-2pf7-77vw , PYSEC-2022-42981
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.
Patch / fix
- pypi apache-airflow 2.3.1
- bitnami airflow 2.3.1
- Apache Software Foundation Apache Airflow 2.3.1
- github.com/apache/airflow@09be0c5 commit
- github.com/apache/airflow@1cbb0ad commit
- github.com/apache/airflow#22754 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.98% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.3.1 |
2.3.1 |
| bitnami | airflow | <2.3.1 |
2.3.1 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/apache/airflow/pull/22754
web, patch, third-party-advisory, advisory
-
github.com
/apache/airflow/commit/09be0c5c7e847dda1d0be5776f8d5e327ff2281a
web
-
github.com
/apache/airflow/commit/1cbb0ad26dd17f218c6ab1c2ae59b262c443a443
web
-
lists.apache.org
/thread/n38oc5obb48600fsvnbopxcs0jpbp65p
web, mailing-list, vendor-advisory, advisory, article
-
openwall.com
/lists/oss-security/2022/11/14/3
mailing-list, web, third-party-advisory, advisory, article
-
nvd.nist.gov
/vuln/detail/CVE-2022-27949
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42981.yaml
web
-
github.com
/advisories/GHSA-fvw2-2pf7-77vw
advisory
Sources
- CVE List CVE-2022-27949
- GitHub Advisory GHSA-fvw2-2pf7-77vw
- NVD CVE-2022-27949
- OSV BIT-airflow-2022-27949
- OSV PYSEC-2022-42981
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.