The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials.
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apache Software Foundation
- Product
- Apache Airflow
- Weakness
- CWE-522
- Exposure class
- Developer platform
- NVD status
- Received
Why it ranks 20 (Routine)
- Product class: developer platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.