CVE-2024-45784 json
Apache Airflow: Sensitive configuration values are not masked in the logs by default
published 2024-11-15 23 mo ago modified 2026-09-08 2 mo ago also BIT-airflow-2024-45784 , EUVD-2024-0009 , GHSA-46c3-5xc5-wwhv , PYSEC-2024-182 , PYSEC-2026-1112
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets.
Patch / fix
- pypi airflow 2.10.3
- bitnami airflow 2.10.3
- pypi apache-airflow 2.10.3
- Apache Software Foundation Apache Airflow 2.10.3
- apache airflow 2.10.3
- github.com/apache/airflow#43040 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | airflow | <2.10.3 |
2.10.3 |
| bitnami | airflow | <2.10.3 |
2.10.3 |
| pypi | apache-airflow | <2.10.3 |
2.10.3 |
Affected products
- Apache Software Foundation Apache Airflow
- apache airflow
Classification
- Weakness
-
- CWE-1295 Debug Messages Revealing Unnecessary Information
References
-
github.com
/apache/airflow/pull/43040
patch, web, issue-tracking, report
-
lists.apache.org
/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2024/11/15/1
web, mailing-list, discussion
-
nvd.nist.gov
/vuln/detail/CVE-2024-45784
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-182.yaml
web
-
pypi.org
/project/airflow
package
-
github.com
/advisories/GHSA-46c3-5xc5-wwhv
advisory
Sources
- CVE List CVE-2024-45784
- GitHub Advisory GHSA-46c3-5xc5-wwhv
- NVD CVE-2024-45784
- OSV BIT-airflow-2024-45784
- OSV PYSEC-2024-182
- OSV PYSEC-2026-1112
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.