PT-2024-34168 · Apache · Apache Airflow

Saurabh Banawar + 1 · Published 2024-11-08 · Updated 2026-03-11 · CVE-2024-50378

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.3

Description: The issue allows authenticated users with audit log access to see sensitive values in audit logs that they should not see. This occurs when sensitive variables are set via the Airflow CLI, resulting in the values being stored unencrypted in the Airflow database. The risk is limited to users with audit log access.

Recommendations: For Apache Airflow versions prior to 2.10.3, upgrade to Airflow 2.10.3 or a later version to address this issue. Additionally, users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BIT-AIRFLOW-2024-50378

CVE-2024-50378

GHSA-J857-2PWM-JJMM

Affected Products

Apache Airflow

References · 18

• https://github.com/apache/airflow/pull/43123 · Patch
• https://osv.dev/vulnerability/CVE-2024-50378 · Vendor Advisory
• https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j857-2pwm-jjmm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-50378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50378 · Security Note
• https://github.com/apache/airflow · Note
• https://t.me/cveNotify/155120 · Telegram Post
• https://twitter.com/CVEnew/status/1854899547060715676 · Twitter Post
• https://t.me/cveNotify/152986 · Telegram Post
• https://t.me/CVEtracker/45588 · Telegram Post
• https://twitter.com/oss_security/status/1854937662874136844 · Twitter Post
• https://t.me/cvedetector/10199 · Telegram Post
• https://twitter.com/fletch_ai/status/1869986246455673265 · Twitter Post
• https://t.me/cvenotify/128460 · Telegram Post