CVE-2024-25142: Apache Airflow Cache-Control Header Vulnerability
Summary
CVE-2024-25142: Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially st... Affects apache-airflow versions < 2.9.2. Fixed in 2.9.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2024-25142 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to orchestrate complex data pipelines and manage task dependencies efficiently. However, prior to version 2.9.2, Airflow had a vulnerability related to the handling of dynamic content caching in web browsers, which could lead to sensitive information being stored in local caches.
Vulnerability Detail
The vulnerability arises from Apache Airflow's failure to return a 'Cache-Control' header for dynamic content. This oversight can lead to certain web browsers caching sensitive data, potentially exposing it to unauthorized access. If a user accesses sensitive information through Airflow, that data may be stored in the browser's cache, making it accessible to anyone who has access to that browser instance. This issue is particularly concerning in shared or public environments where multiple users may access the same machine.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually clear their browser cache after accessing sensitive information in Apache Airflow. Additionally, configuring the web server to set appropriate cache headers for dynamic content can help mitigate the risk until an upgrade is performed.
Conclusion
The vulnerability identified as CVE-2024-25142 in Apache Airflow poses a risk of sensitive information being cached in web browsers due to the absence of a 'Cache-Control' header for dynamic content. Users are strongly encouraged to upgrade to version 2.9.2 or later to mitigate this risk. Temporary workarounds are available but should not replace the need for an upgrade.
See every vulnerability recorded for apache-airflow →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
All versions of Apache Airflow prior to 2.9.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, ensure to clear your browser cache after accessing sensitive data and consider setting appropriate cache headers on your web server.
More information can be found in the official advisory on the Apache Airflow GitHub repository and related security databases.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
