CVE-2022-46651 json
Apache Airflow: Security vulnerability on AirFlow Connections
published 2023-07-12 3 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2022-46651 , EUVD-2023-0009 , GHSA-xvw9-3mhm-xjqq , PYSEC-2023-103
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
Patch / fix
- pypi apache-airflow 2.6.3
- bitnami airflow 2.6.3
- Apache Software Foundation Apache Airflow 2.6.3
- github.com/apache/airflow@d012483 commit
- github.com/apache/airflow#32309 pull request
- lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.6.3 |
2.6.3 |
| bitnami | airflow | <2.6.3 |
2.6.3 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/apache/airflow/pull/32309
patch, web
-
lists.apache.org
/thread/n45h3y82og125rnlgt6rbm9szfb6q24d
vendor-advisory, web, mailing-list, patch, advisory
-
github.com
/apache/airflow/commit/d01248382fe45a5f5a7fdeed4082a80c5f814ad8
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-46651
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-103.yaml
web
-
github.com
/advisories/GHSA-xvw9-3mhm-xjqq
advisory
Sources
- CVE List CVE-2022-46651
- GitHub Advisory GHSA-xvw9-3mhm-xjqq
- NVD CVE-2022-46651
- OSV BIT-airflow-2022-46651
- OSV PYSEC-2023-103
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.