Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Apache Airflow may reveal internal details in error messages

CVE-2023-25695 · published 3 years ago
Summary

Apache Airflow versions prior to 2.5.2 can include sensitive configuration data in the text of error messages it returns. This could allow users or attackers who see those messages to learn secrets such as passwords or internal system paths. Upgrade to version 2.5.2 or later, or adjust the logging settings to hide detailed information.

What to do
  • Update apache software foundation apache-airflow to version 2.5.2rc1.
  • Update apache airflow to version 2.5.2 or later.
Affected software
Ecosystem VendorProductAffected versions
– apache airflow < 2.5.2
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
pip apache software foundation apache-airflow < 2.5.2rc1
Fix: upgrade to 2.5.2rc1
Original advisory text
Information disclosure in Apache Airflow
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.

References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published15 Mar 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2023-25695 · OSV
GHSA-h6g5-wqqr-3mw3 · GHSA
CVE-2023-25695 · NVD
Track software like this
Free during beta