Apache Airflow Vulnerability: Exposure of Sensitive Information
Summary
CVE-2023-46288: Apache Airflow vulnerable to Exposure of Sensitive Information. Affects apache-airflow versions >= 2.4.0, < 2.7.2. Fixed in 2.7.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2023-46288 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating data pipelines. However, versions 2.4.0 to 2.7.0 of Apache Airflow are vulnerable to an Exposure of Sensitive Information issue.
Vulnerability Detail
The Exposure of Sensitive Information vulnerability in Apache Airflow allows authenticated users with read configuration access via the Airflow REST API to view sensitive configuration information. This vulnerability affects versions 2.4.0 to 2.7.0. Even when the 'expose_config' option is set to non-sensitive-only, authenticated users can still access sensitive configuration information. The default value for 'expose_config' is False. It is important to note that this vulnerability is different from CVE-2023-45348, which allows authenticated users to retrieve individual configuration values by crafting specific requests. The issue has been resolved in version 2.7.2.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Exposure of Sensitive Information vulnerability in Apache Airflow can lead to the unauthorized access of sensitive configuration information. To mitigate this vulnerability, it is crucial to upgrade to Apache Airflow version 2.7.2 or a later version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating data pipelines.
Versions 2.4.0 to 2.7.0 of Apache Airflow are affected by this vulnerability.
The 'expose_config' option in Apache Airflow determines whether sensitive configuration information is exposed via the Airflow REST API. By default, the value is set to False.
To fix this vulnerability, upgrade Apache Airflow to version 2.7.2 or a later version that is not affected.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to a fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
