Threats tagged 'ghsa-j7hg-ffg5-7mfr'

Apache Airflow's audit logs stored secret values from Connections and Variables in cleartext within the Log.extra column. This occurred because the secrets masker only matched configured sensitive key names, failing to mask all secret values. An authenticated user with low privileges and read access to the audit API could retrieve these secrets without prior access to the underlying resources. The issue is fixed in Apache Airflow version 3.4.0, which masks secret values properly and restricts audit log access to authorized users.