Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access
    to see sensitive values in audit logs which they should not see. When sensitive variables were set via
    airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the
    Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade
    to Airflow 2.10.3 or a later version, which addresses this issue. Users who previously used the CLI to set
    secret variables should manually delete entries with those variables from the log table. (CVE-2024-50378)

ID	Name	Product	Family	Type	Severity
464882	Echo: apache-airflow: security update to 2.10.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464882	Echo: apache-airflow: security update to 2.10.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
416228	SCA: security update for apache-airflow (GHSA-j857-2pwm-jjmm)	Tenable Cloud Security	SCA Checks	Local	medium
416228	SCA: security update for apache-airflow (GHSA-j857-2pwm-jjmm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-50378

medium

Tenable Plugins

medium

medium

medium

medium