apache-airflow 3.2.2rc3

Direct Vulnerabilities

Known vulnerabilities in the apache-airflow package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Removal of Sensitive Information Before Storage or Transfer apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the Config API when per-key secrets backend overrides are configured via environment variables. An attacker can obtain plaintext secrets-backend credentials by accessing the API output, as sensitive information is not properly redacted. This is only exploitable if secrets backends are configured using per-key environment variable overrides. How to fix Improper Removal of Sensitive Information Before Storage or Transfer? Upgrade `apache-airflow` to version 3.3.0b1 or higher.	[,3.3.0b1)
H Cleartext Transmission of Sensitive Information apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the `FTPSHook.get_conn` process not invoking `prot_p`, resulting in the data channel being transmitted in cleartext. An attacker can intercept sensitive file contents and credentials by monitoring the network traffic between the client and server. How to fix Cleartext Transmission of Sensitive Information? Upgrade `apache-airflow` to version 3.3.0b1 or higher.	[,3.3.0b1)

Vulnerability

Vulnerable Version

Improper Removal of Sensitive Information Before Storage or Transfer

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the Config API when per-key secrets backend overrides are configured via environment variables. An attacker can obtain plaintext secrets-backend credentials by accessing the API output, as sensitive information is not properly redacted. This is only exploitable if secrets backends are configured using per-key environment variable overrides.

How to fix Improper Removal of Sensitive Information Before Storage or Transfer?

Upgrade apache-airflow to version 3.3.0b1 or higher.

[,3.3.0b1)

Cleartext Transmission of Sensitive Information

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the FTPSHook.get_conn process not invoking prot_p, resulting in the data channel being transmitted in cleartext. An attacker can intercept sensitive file contents and credentials by monitoring the network traffic between the client and server.

How to fix Cleartext Transmission of Sensitive Information?

Upgrade apache-airflow to version 3.3.0b1 or higher.

[,3.3.0b1)

apache-airflow@3.2.2rc3

Programmatically author, schedule and monitor data pipelines

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically