CVE-2023-35005
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
In Apache Airflow, there is a vulnerability that may expose potentially sensitive values to users in certain situations. This issue affects versions from 2.5.0 before 2.6.2.
Risk Assessment
The exposure of sensitive data may lead to privacy and security breaches for the organization, especially if users have access to confidential information.
Recommendation
It is recommended to update to version 2.6.2 or later to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.