Saurabh Banawar

**Name of the Vulnerable Software and Affected Versions** Airflow versions prior to 3.1.8 **Description** The secrets masker failed to mark the `access key` and `connection string` connection properties as sensitive. This allows users with read permissions to view these values in the Connection UI. Additionally, if a Connection is accidentally recorded in logs, these values are exposed. Azure Service Bus uses these properties to store sensitive data, and other providers using the same fields may also be affected. **Recommendations** Upgrade to version 3.1.8.

**Name of the Vulnerable Software and Affected Versions** Airflow versions prior to 3.2.0 **Description** Lack of clarity regarding the responsibilities of the Deployment Manager in ensuring secure deployments. Certain assumptions about the security model, workload isolation, and JWT authentication were not explicit enough, which could lead to insecure configurations. The Deployment Manager is ultimately responsible for securing the deployment. **Recommendations** Upgrade to version 3.2.0.

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0 Description Apache Airflow is affected by an issue where JWT tokens remain valid after a user logs out, potentially allowing unauthorized access if the token is intercepted. The JWT token associated with a user's authentication was not invalidated upon logout. This could allow an attacker who intercepts the token to reuse it for unauthorized access. Recommendations Upgrade to version 3.2.0 or later to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** Grafana (affected versions not specified) **Description** A medium-severity flaw in Grafana Alerting exposes sensitive DingDing contact point URLs to viewers. This issue may lead to data exposure. **Recommendations** Update to a patched version to resolve the issue. As a temporary workaround, consider disabling the DingDing integration until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Fab Provider versions prior to 1.5.2 **Description** The issue affects Apache Airflow Fab Provider when a user's password is changed using the admin CLI, leading to insufficient session expiration. This allows logged-in users to remain connected even after the password change. The problem does not occur when the password is changed through the web server. **Recommendations** To resolve the issue, upgrade to version 1.5.2, which fixes the problem.

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions before 2.10.3 Description: The issue is related to the exposure of sensitive configuration variables in task logs. This could allow unauthorized users to access critical data, potentially compromising the security of the Airflow deployment. The estimated number of potentially affected devices worldwide is over 54,000, as indicated by a search on ZoomEye. Recommendations: To resolve the issue, users should upgrade to Airflow 2.10.3 or the latest version. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets.

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.3 Description: The issue allows authenticated users with audit log access to see sensitive values in audit logs that they should not see. This occurs when sensitive variables are set via the Airflow CLI, resulting in the values being stored unencrypted in the Airflow database. The risk is limited to users with audit log access. Recommendations: For Apache Airflow versions prior to 2.10.3, upgrade to Airflow 2.10.3 or a later version to address this issue. Additionally, users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.

**Name of the Vulnerable Software and Affected Versions** KeystoneJS versions prior to 4.0.0 **Description** The issue allows for application-wide CSRF bypass by removing the CSRF parameter and value. It fails to reject requests that lack an `x-csrf-token` header, which may allow attackers to carry actions on behalf of other users on all endpoints. **Recommendations** Update to version 4.0.0 or later. As a temporary workaround, consider restricting access to all endpoints until a patch is available. Avoid using endpoints that do not require the `X-CSRF-Token` header until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pagekit CMS versions prior to 1.0.11 **Description** An issue allows a remote attacker to reset a registered user's password when the debug toolbar is enabled, successfully recovering the password. **Recommendations** For versions prior to 1.0.11, update to version 1.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the debug toolbar until a patch is available.