CVE-2022-40604: Apache Airflow - Information Extraction Vulnerability
Summary
CVE-2022-40604: In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction. Affects apache-airflow versions >= 2.3.0, < 2.4.0b1. Fixed in 2.4.0b1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2022-40604 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing complex data pipelines. The vulnerability described here affects Apache Airflow versions 2.3.0 through 2.3.4. These versions include a formatting issue in a URL, which may allow an attacker to extract sensitive information.
Vulnerability Detail
The vulnerability in Apache Airflow arises from an unnecessary formatting of a part of a URL. This formatting issue can be exploited by an attacker to extract information that should not be accessible. By manipulating the URL, an attacker may gain unauthorized access to sensitive data or perform other malicious activities. This vulnerability poses a risk to the confidentiality and integrity of the affected system.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0b1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.4.0b1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The information extraction vulnerability in Apache Airflow can be mitigated by upgrading to version 2.4.0b1 or later. It is crucial to keep software up to date to ensure the security and integrity of systems. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform for managing and orchestrating workflows. It allows users to define, schedule, and monitor complex data pipelines.
The vulnerability affects Apache Airflow versions 2.3.0 through 2.3.4.
This vulnerability may allow an attacker to extract sensitive information from the affected system, potentially leading to unauthorized access or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 2.4.0b1 or later.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
