Riskcovery

CVE-2023-46215

Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend

State
Published
Severity
7.5 High
Published
Oct 28, 2023
Updated
Jun 12, 2025
Reserved
Oct 18, 2023

Read the record on cve.org

Description

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.

Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs.

This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.

Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCISA-ADP

Weaknesses

  • CWE-532 Insertion of Sensitive Information into Log File

Affected Products

ProductVersions
Apache Airflow Celery providerApache Software Foundation
  • 3.3.0 through 3.4.0Affected
Apache AirflowApache Software Foundation
  • 1.10.0 to before 2.7.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.