Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-46215: Apache Airflow (Celery) logs sensitive data in clear text
CVE-2023-46215 · published 3 years ago
Summary
When Airflow uses the Celery result backend with rediss, AMQP, or RPC protocols, it writes passwords and other confidential details to its log files without masking them. This means anyone who can read the logs could see that information. Upgrade the Celery provider to version 3.4.1 and Airflow to version 2.7.0 to stop the data from being recorded in clear text.
What to do
- Update apache software foundation apache-airflow-providers-celery to version 3.4.1.
- Update rootio-apache-airflow to version 2.3.3+root.io.5.
- Update apache software foundation apache-airflow to version 2.7.0.
- Update apache airflow to version 2.7.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | apache software foundation | apache-airflow-providers-celery |
>= 3.3.0, < 3.4.1 Fix: upgrade to 3.4.1
|
| – | apache | airflow |
>= 1.10.0, < 2.7.0 cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* |
| – | apache | airflow_celery_provider |
>= 3.3.0, <= 3.4.0 cpe:2.3:a:apache:airflow_celery_provider:*:*:*:*:*:*:*:* |
| Root:PyPI | – | rootio-apache-airflow |
< 2.3.3+root.io.5 Fix: upgrade to 2.3.3+root.io.5
|
| pip | apache software foundation | apache-airflow |
>= 1.10.0, < 2.7.0 Fix: upgrade to 2.7.0
|
Original advisory text
Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.
Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
Note: the vulnerability is about the information exposed in the logs not about accessing the logs.
This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.
Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.
Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
Note: the vulnerability is about the information exposed in the logs not about accessing the logs.
This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.
Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.
References
- https://github.com/advisories/GHSA-666g-rfc5-c9jv
- http://www.openwall.com/lists/oss-security/2023/10/28/1 URL
- https://pypi.python.org URL
- https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46215... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-46215 Vendor Advisory
- https://github.com/apache/airflow/pull/34954 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published28 Oct 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta