| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow | < 1.10.13 | 1.10.13 |
| airflow | < 1.10.13 | 1.10.13 |
In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. The same happenes when creating a Connection with a password field.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free