VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jun 19, 2023· Updated Jun 17, 2026

CVE-2023-35005

CVE-2023-35005

Description

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.

This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if [webserver] expose_config is set to non-sensitive-only), and not all uncensored values are actually sentitive.

This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
apache-airflowPyPI
>= 2.5.0, < 2.6.2rc12.6.2rc1

Affected products

4
  • Apache/Airflow2 versions
    cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*range: >=2.5.0,<2.6.2
    • (no CPE)range: 2.5.0
  • osv-coords2 versions
    pkg:bitnami/airflowpkg:pypi/apache-airflow
    >= 2.5.0, < 2.6.2+ 1 more
    • (no CPE)range: >= 2.5.0, < 2.6.2
    • (no CPE)range: >= 2.5.0, < 2.6.2rc1

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.