Vulnerability · Published Oct 28, 2023 · Assigned by apache
CVE-2023-46215Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
High 7.5
In plain English
A high-severity sensitive data in logs in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow | 2.7.0 | GHSA-666g-rfc5-c9jv |
| PyPI | apache-airflow | 2.7.0 | PYSEC-2026-1131 |
| PyPI | apache-airflow-providers-celery | 3.4.1 | GHSA-666g-rfc5-c9jv |
| PyPI | apache-airflow-providers-celery | 3.4.1 | PYSEC-2026-2364 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow Celery provider | 3.3.0 – through 3.4.0 |
| Apache Software Foundation | Apache Airflow | 1.10.0 – before 2.7.0 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N