CVE-2024-31869: apache software foundation apache airflow
Vulnerability summary
CVE-2024-31869 is a medium (CVSS 5.3) vulnerability in apache software foundation apache airflow. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 63.8% of scored vulnerabilities.
Timeline
- 18-04-2024PublishedVulnerability first disclosed.
- 13-03-2025Last modifiedVulnerability information updated.
Description
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
1.06%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.06% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- airflow≥ 2.7.0, < 2.9.0
Apache software foundation1 product
- apache airflow≥ 2.7.0, ≤ 2.8.4
PyPI1 product
- apache-airflow≥ 2.7.0, < 2.9.0
3 vendors · 3 products
References
8 links
- github.com/apache/airflowPACKAGE