Opensec Intelligence

Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API. Users of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

يمنح نظام تزويد الفرق المتعددة في مزود Keycloak الخاص بـ Apache Airflow كل دور فريق صلاحية القراءة العالمية لسجلات التدقيق. يحدث هذا ضمن الدالة ` attach team permissions()`. في عمليات النشر التي تفعل وضع الفرق المتعددة باستخدام مدير مصادقة Keycloak لتزويد الفرق، يمكن لأي عضو مصادق عليه في أحد الفرق قراءة أحداث التدقيق الخاصة بفرق أخرى من خلال واجهة المستخدم أو نقطة نهاية واجهة برمجة تطبيقات سجل الأحداث (event-log API).

The Core API logout endpoint only revokes session tokens provided via the ` token` cookie. If a client uses an Authorization bearer header for authentication during logout, the endpoint returns a successful response without revoking the token. This allows the token to remain valid until its expiration, which is 24 hours by default. An attacker possessing a copy of this token can maintain access to the victim's account even after the victim has logged out.

Changing a user password via the Admin user-edit PATCH endpoint fails to invalidate existing database-backed sessions. This allows an attacker possessing a victim's session cookie to maintain full access to the account even after a password reset. This issue specifically affects deployments using the FAB auth manager with database-backed sessions. The trigger is a routine password change performed by an administrator or the user, requiring no direct interaction from an attacker with the endpoint.