CVE-2020-17511: Plain Text Storage of Passwords in Apache Airflow
Summary
CVE-2020-17511: Apache Airflow logs passwords in plaintext. Affects apache-airflow versions < 1.10.13. Fixed in 1.10.13. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-17511 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features and tools for managing complex data pipelines. However, prior to version 1.10.13, Apache Airflow had a vulnerability that allowed passwords to be stored in plain text in the Log table in Airflow Metadata. This vulnerability also affected the creation of Connections with password fields.
Vulnerability Detail
The vulnerability in Apache Airflow allowed passwords to be logged in plain text, which poses a significant security risk. If an attacker gains access to the Airflow Metadata or Log table, they can easily retrieve sensitive information such as user passwords or connection credentials. This can lead to unauthorized access, data breaches, and other malicious activities. The vulnerability was assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2020-17511 and has a severity rating of MODERATE according to the Common Weakness Enumeration (CWE) classification (CWE-312).
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.13
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache Airflow.
Conclusion
In conclusion, the vulnerability in Apache Airflow allowed passwords to be stored in plain text, posing a significant security risk. Upgrading to Apache Airflow version 1.10.13 or later is recommended to fix this vulnerability and ensure the secure storage of passwords. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features and tools for managing complex data pipelines.
The vulnerability allows passwords to be stored in plain text, which can be accessed by unauthorized individuals. This can lead to unauthorized access, data breaches, and other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 1.10.13 or later.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache Airflow.
The vulnerability has a severity rating of MODERATE according to the Common Weakness Enumeration (CWE) classification (CWE-312).
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
