Threats tagged 'ghsa-qv7j-fgv4-c4rc'

Apache Airflow versions prior to 3.4.0 had a flaw in their secrets masker where sensitive keys were only matched in snake_case form. As a result, sensitive values stored under camelCase keys such as privateKey, connectionString, webhookUrl, or accessKey were not redacted in task logs, rendered templates, or API responses. This could allow unauthorized users with access to task logs or rendered templates to view sensitive credentials in cleartext. Upgrading to Apache Airflow 3.4.0 or later addresses this issue.