| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow | ≥ 2.0.0, < 2.0.1rc1< 2.0.1 | 2.0.1rc12.0.1 |
| airflow | = 2.0.0 |
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when [webserver] expose_config is set to False in airflow.cfg. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free