All vulnerabilities

Servers and applications

CVE-2023-51702

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in…

Severity
Medium 6.5
Published
24 Jan 2024
Last changed
2 Jul 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.6.1
Sources
NVD

Affected software

SoftwareAffected versions
Apache AirflowServers and applications · cpe:a:apache:airflow
  • From 2.3.0 before 2.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-51702
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-51702