Threats tagged 'ghsa-xww4-3839-4p9j'

Apache Airflow's CLI audit logging masks secrets based on argument position, but some command argument patterns leave secrets exposed in cleartext within audit logs. This affects commands such as Variable commands with trailing --description, --conn-extra, and inline --password in airflow keycloak-auth-manager commands. Users with read access to audit logs but without Variable or Connection permissions can retrieve sensitive secrets via the event-log API. Users are advised to upgrade to version 3.4.0 or later and to purge old audit log entries containing exposed secrets and rotate those secrets.