Medium severity · published Jun 19, 2023
CVE-2023-35005
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations
6.5
CVSS
1.5%
EPSS
No
On KEV
Description
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.
This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive.
This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Airflow · Apache
2.5.0 before 2.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-35005
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-35005
Patch
https://github.com/apache/airflow/pull/31788
Issue Tracking
https://github.com/apache/airflow/pull/31820
Mailing List
https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd
More from Airflow
9.8
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
8.8
CVE-2020-11978
Apache Airflow Command Injection
9.8
CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
9.8
CVE-2023-25754
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0
9.8
CVE-2023-22884
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache…