| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow | < 3.2.2 | 3.2.2 |
| airflow | < 3.2.2 | 3.2.2 |
A bug in the GET /api/v2/connections/{connection_id} REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's extra JSON blob under field names not present in the redaction allowlist (DEFAULT_SENSITIVE_FIELDS) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection extra blobs and grant Connection-read access to multiple users. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's extra field.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free