Analysis Summary

CVE-2024-31869

Apache Airflow could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration. By sending a specially crafted request, an attacker could exploit this vulnerability to see sensitive provider configuration, and use this information to launch further attacks against the affected system.

Impact

• Information Disclosure

Indicators of Compromise

CVE

• CVE-2024-31869

Affected Vendors

Remediation

Upgrade to the latest version of Apache Airflow, available from the Airflow GIT Repository.

Airflow GIT Repository