CVE-2017-17836: Apache Airflow - Exfiltration of Credentials
Summary
CVE-2017-17836: In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. Affects apache-airflow versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure. Airflow provides a web-based UI for managing workflows and supports various integrations with databases, cloud services, and other tools. However, versions 1.8.2 and earlier of Apache Airflow contain a vulnerability that exposes authenticated cookies and database passwords, allowing an attacker with limited access to exfiltrate all credentials from the system.
Vulnerability Detail
The vulnerability in Apache Airflow arises from an experimental feature that inadvertently displays authenticated cookies and database passwords used by the application. This feature can be exploited by an attacker who has limited access to the Airflow system, either through a cross-site scripting (XSS) attack or by gaining physical access to a machine with an unlocked session. By leveraging this vulnerability, an attacker can obtain sensitive credentials, potentially leading to unauthorized access to databases and other systems connected to Airflow. It is important to note that this vulnerability was addressed in version 1.9.0 of Apache Airflow.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Apache Airflow versions 1.8.2 and earlier allows for the exfiltration of credentials, including authenticated cookies and database passwords. To mitigate this risk, users should upgrade to at least version 1.9.0 of Apache Airflow. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a web-based UI and supports various integrations with databases, cloud services, and other tools.
This vulnerability allows an attacker with limited access to exfiltrate all credentials from the Apache Airflow system, including authenticated cookies and database passwords. It could potentially lead to unauthorized access to databases and other systems connected to Airflow.
An attacker can exploit this vulnerability by leveraging a cross-site scripting (XSS) attack or gaining physical access to a machine with an unlocked session. By doing so, they can retrieve sensitive credentials from the Airflow system.
Yes, this vulnerability has been fixed in version 1.9.0 of Apache Airflow. It is recommended to upgrade to this version or later to mitigate the risk.
You can find more information about this vulnerability in the Apache Airflow advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2019-149.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
