CVE-2023-46215: Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability
Summary
CVE-2023-46215: Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability. Affects apache-airflow-providers-celery versions >= 3.3.0, < 3.4.1. Fixed in 3.4.1. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- airflow · Bitnami
The same CVE-2023-46215 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, schedule, and monitor complex workflows as directed acyclic graphs (DAGs). The Celery provider is a component of Apache Airflow that enables the execution of tasks in a distributed manner using the Celery distributed task queue. This vulnerability affects the Celery provider in Apache Airflow versions 3.3.0 through 3.4.0, as well as Apache Airflow versions 1.10.0 through 2.6.3.
Vulnerability Detail
The vulnerability in the Apache Airflow Celery provider involves the insertion of sensitive information into log files. When using the rediss, amqp, or rpc protocols as the Celery result backend, sensitive information is logged in clear text. This issue does not pertain to accessing the logs but rather the exposure of sensitive information within them. The impact of this vulnerability is the potential disclosure of sensitive data, which could lead to unauthorized access or other security breaches.
How To Fix
Latest published version: 3.25.0 as of 22 Oct 2026
pip install --upgrade "apache-airflow-providers-celery==3.25.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow-providers-celery==3.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability exposes sensitive information in log files, potentially leading to unauthorized access or security breaches. Users are strongly advised to upgrade to the recommended versions of the Airflow Celery provider and Apache Airflow to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow-providers-celery →
FAQ
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, schedule, and monitor complex workflows as directed acyclic graphs (DAGs).
The Celery provider is a component of Apache Airflow that enables the execution of tasks in a distributed manner using the Celery distributed task queue.
This vulnerability affects Apache Airflow versions 1.10.0 through 2.6.3.
This vulnerability affects the Airflow Celery provider versions 3.3.0 through 3.4.0.
The impact of this vulnerability is the potential disclosure of sensitive data, which could lead to unauthorized access or other security breaches.
