Apache Airflow Sensitive Information Exposure Vulnerability in Connections

A vulnerability in Apache Airflow 3.0.3 allows sensitive connection details to be accessed by users with READ permissions, through both the API and the UI. This issue arises from an unintended violation of a 'write-only' model for sensitive values, which was introduced in Airflow 3. The vulnerability also bypasses the 'AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS' configuration option. This issue does not affect Airflow 2.x, where the exposure of sensitive information to connection editors was intentional and documented.

Impact

The vulnerability allows unauthorized users to view sensitive connection information, which could lead to the disclosure of confidential data or credentials.

Remediation

Users of Apache Airflow 3.0.3 are advised to upgrade to version 3.0.4 or later.