CVE-2023-46288 json
Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is set
published 2023-10-23 3 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2023-46288 , EUVD-2023-0025 , GHSA-9qqg-mh7c-chfq , PYSEC-2023-218
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0.
Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2).
Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348.
Patch / fix
- pypi apache-airflow 2.7.0, 2.7.2
- bitnami airflow 2.7.0
- Apache Software Foundation Apache Airflow 2.7.0
- github.com/apache/airflow@4a525e8 commit
- github.com/apache/airflow#32261 pull request
- lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | >=2.4.0, <2.7.2 >=2.4.0, <2.7.0 |
2.7.2 2.7.0 |
| bitnami | airflow | >=2.4.0, <2.7.0 |
2.7.0 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/apache/airflow/pull/32261
patch, web
-
lists.apache.org
/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw
vendor-advisory, web, mailing-list, patch, advisory, article
-
github.com
/apache/airflow/commit/4a525e85e31b26d413c986c86d181114bb37bd06
web
-
openwall.com
/lists/oss-security/2024/04/17/10
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-46288
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-218.yaml
web
-
github.com
/advisories/GHSA-9qqg-mh7c-chfq
advisory
Sources
- CVE List CVE-2023-46288
- GitHub Advisory GHSA-9qqg-mh7c-chfq
- NVD CVE-2023-46288
- OSV BIT-airflow-2023-46288
- OSV PYSEC-2023-218
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.