CVE-2024-45784: Apache Airflow Sensitive Configuration Exposure in Task Logs
Summary
CVE-2024-45784: Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. Affects apache-airflow versions < 2.10.3. Fixed in 2.10.3. How to fix ↓
Also tracked for
The same CVE-2024-45784 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) and provides a rich user interface to manage and visualize these workflows. However, prior to version 2.10.3, Airflow had a vulnerability that could lead to the exposure of sensitive configuration variables in task logs, potentially compromising the security of the deployment.
Vulnerability Detail
The vulnerability in Apache Airflow versions before 2.10.3 allows DAG authors to unintentionally or intentionally log sensitive configuration variables. This could lead to unauthorized access to logs by users who should not have access to this sensitive information. The exposure of such critical data could be exploited to compromise the security of the Airflow deployment, making it essential for users to be aware of this risk.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.3
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.10.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, it is recommended to review existing logs for any sensitive information that may have been logged and to ensure that logs are protected from unauthorized access.
Conclusion
The vulnerability identified as CVE-2024-45784 in Apache Airflow poses a significant risk by allowing sensitive configuration variables to be logged. Users are strongly advised to upgrade to version 2.10.3 or later to mitigate this risk. Additionally, reviewing existing logs and securing them is crucial to maintaining the security of your Airflow deployment.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow versions prior to 2.10.3 are affected by this vulnerability.
Sensitive configuration variables, such as API keys and passwords, could be exposed in task logs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you suspect that sensitive information has been logged, it is recommended to update those secrets and secure your logs to prevent unauthorized access.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
