CVE-2023-40712: Apache Airflow - Unmasking Secret Configuration
Summary
CVE-2023-40712: Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration... Affects apache-airflow versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2023-40712 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, manage, and monitor complex workflows as Directed Acyclic Graphs (DAGs). The platform provides a web-based UI for users to interact with and visualize their workflows. However, versions before 2.7.1 are affected by a vulnerability that can be exploited by authenticated users with access to the task/DAG UI. These users can craft a URL that can reveal the secret configuration of a task, which would otherwise be masked in the UI.
Vulnerability Detail
The vulnerability in Apache Airflow allows authenticated users to bypass the UI's masking mechanism and access the secret configuration of a task. By crafting a specific URL, an attacker can retrieve sensitive information that should be hidden from view. This can lead to the exposure of credentials, API keys, or other confidential data associated with the task. The vulnerability poses a risk to the security and integrity of the workflows and the systems they interact with.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the patched version is the only reliable solution.
Conclusion
Apache Airflow versions before 2.7.1 are vulnerable to an issue that allows authenticated users to unmask secret configurations of tasks in the UI. Upgrading to version 2.7.1 or later is strongly recommended to address this vulnerability and ensure the security of workflows. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
You can check the version of Apache Airflow installed in your environment by running the command 'airflow version'. If the version is earlier than 2.7.1, it is affected by this vulnerability.
No, this vulnerability requires authentication and access to the task/DAG UI. It cannot be exploited remotely without valid credentials.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to upgrade to the patched version to mitigate the risk.
The vulnerability itself does not impact the core functionality of Apache Airflow. However, the exposure of secret configurations can have serious security implications for the workflows and systems involved.
You can find more information about this vulnerability in the Apache Airflow advisory database. The source link is provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
