Apache Airflow JWT Token Exposure in Logs Vulnerability

A vulnerability exists in Apache Airflow versions 3.0.0 prior to 3.2.0, where JSON Web Tokens (JWT) used by tasks are logged in plain text. This exposure could potentially allow users interacting with the UI to impersonate DAG authors. The issue has been addressed in Airflow version 3.2.0.

Impact

The vulnerability allows for unauthorized actions to be performed as a DAG author, potentially leading to manipulation of workflows or data.

Reproduction

The vulnerability can be reproduced by running any DAG in Apache Airflow 3.1.7 with the official Airflow Helm Chart deployed. The JWT tokens will appear in the task logs.

Remediation

Users are advised to upgrade to Apache Airflow version 3.2.0, which includes the necessary fix.