CVE-2023-40712
Apache Airflow: Secrets can be unmasked in the "Rendered Template"
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
12 Sep 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.
Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.
Affected products
Apache Software Foundation · Apache AirflowWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →