Apache Airflow Connection Secrets Exposure Vulnerability

A vulnerability exists in Apache Airflow versions prior to 2.11.1, allowing authenticated users with audit log access to view sensitive connection parameters in audit logs. These values, when set through the Airflow CLI, were logged unencrypted and stored in the Airflow database. Although this issue primarily affects users with audit log access, it is advisable to upgrade to Airflow 2.11.1 or later. Additionally, users who have used the CLI to configure connections should manually remove any sensitive entries from the audit log database table.

Impact

This vulnerability could lead to unauthorized exposure of sensitive connection details in the audit logs and the Airflow database.

Remediation

Users should upgrade to Apache Airflow version 2.11.1 or later. Those who have previously used the CLI to set connections should manually delete entries containing sensitive values from the audit log table.