CVE-2024-50378

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.3

Description: The issue allows authenticated users with audit log access to see sensitive values in audit logs that they should not see. This occurs when sensitive variables are set via the Airflow CLI, resulting in the values being stored unencrypted in the Airflow database. The risk is limited to users with audit log access.

Recommendations: For Apache Airflow versions prior to 2.10.3, upgrade to Airflow 2.10.3 or a later version to address this issue. Additionally, users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.