CVE-2024-45784: Apache Airflow Information Disclosure Flaw

CVE-2024-45784 Overview

CVE-2024-45784 is an information disclosure vulnerability in Apache Airflow versions before 2.10.3. The flaw allows sensitive configuration variables to be exposed in task logs because secrets are not masked in logging output. DAG authors can unintentionally or intentionally write secret values to logs, and any user with read access to those logs can recover the cleartext data. Unauthorized access to these logs can expose credentials, API keys, and other configuration secrets used to compromise the Airflow deployment.

Critical Impact
Network-accessible attackers with log read permissions can harvest cleartext secrets from Airflow task logs, enabling lateral movement into systems orchestrated by the affected Airflow deployment.

Affected Products

Apache Airflow versions prior to 2.10.3
Deployments where DAG authors reference configuration variables in task code
Airflow installations without additional log access controls or external log masking

Discovery Timeline

2024-11-15 - CVE-2024-45784 published to NVD and disclosed on the OpenWall oss-security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45784

Vulnerability Analysis

The weakness is categorized under [CWE-1295] (Debug Messages Revealing Unnecessary Information). Apache Airflow processes Directed Acyclic Graphs (DAGs) that orchestrate workflows, and these workflows frequently reference configuration variables containing connection strings, tokens, and other secrets. Prior to version 2.10.3, the task logging subsystem did not mask configuration variable values written to task logs.

When a DAG author included statements that emitted configuration variables, whether through explicit print() calls, logger output, or exception traces, the literal secret values were persisted to the task log files. Any principal with permission to view task logs through the Airflow UI, REST API, or the underlying log storage backend could read the secrets in cleartext.

The impact is confined to confidentiality, with no direct integrity or availability impact. However, recovered secrets often grant access to downstream databases, cloud accounts, and SaaS APIs referenced by the affected DAGs.

Root Cause

The root cause is missing secret masking in the task logging pipeline. Airflow already provided a secret masker for known sensitive fields surfaced in the UI, but configuration variables accessed via the standard variable API were not consistently registered with the masker before being written to task log handlers. The fix delivered in pull request GitHub Pull Request 43040 extends masking to cover configuration variables in task logs.

Attack Vector

Exploitation requires network access to the Airflow web server, REST API, or shared log storage, plus permission to read task logs. An attacker with a low-privilege Airflow account that can view logs for at least one DAG can iterate over historical task runs and extract any secret previously written to the log stream. No authentication is required at the vulnerable component itself if logs are stored on an unprotected backend such as a misconfigured S3 bucket or shared filesystem.

The vulnerability is fully passive against the Airflow control plane and requires no special tooling, only log read access. See the Apache Mailing List Thread for the upstream advisory describing the disclosure surface.

Detection Methods for CVE-2024-45784

Indicators of Compromise

Task log files containing cleartext values matching the patterns of known Airflow Variables, Connections, or secret backend entries
Unexpected access to the /api/v1/dags/{dag_id}/dagRuns/{run_id}/taskInstances/{task_id}/logs/{try_number} REST endpoint by low-privilege accounts
Bulk downloads of task logs from object storage backends used by Airflow
Authentication attempts against downstream systems originating from IP addresses that previously read Airflow logs

Detection Strategies

Scan existing task logs for high-entropy strings, AWS access key patterns, JWTs, and known secret prefixes to identify prior leakage
Review Airflow audit logs and reverse proxy logs for users who read task logs they did not author or own
Compare deployed Airflow version against 2.10.3 across all environments and flag instances running earlier releases

Monitoring Recommendations

Enable access logging on the log storage backend (S3, GCS, Azure Blob, or shared volume) and alert on anomalous read patterns
Monitor outbound authentication failures on systems whose credentials are stored as Airflow Variables, as failures may follow credential rotation after a leak
Track DAG code commits that introduce print or logging statements referencing Variable.get() or connection objects

How to Mitigate CVE-2024-45784

Immediate Actions Required

Upgrade Apache Airflow to version 2.10.3 or later on all schedulers, workers, and web servers
Rotate any secrets, Variables, and Connections that may have been written to task logs while running an affected version
Restrict task log read permissions to the minimum set of users required for operational support
Audit DAG source code for explicit logging of Variable.get(), BaseHook.get_connection(), or environment variables

Patch Information

The fix is included in Apache Airflow 2.10.3, which extends the secret masker to cover configuration variables in task logs. The code change is tracked in GitHub Pull Request 43040 and announced in the OpenWall OSS Security Update. Users on older minor releases should plan an upgrade path to the 2.10.x series.

Workarounds

Register sensitive variable names with Airflow's secret masker by ensuring variable keys include substrings such as password, secret, token, or api_key so the existing masker engages
Move secrets out of Airflow Variables into a dedicated secrets backend such as HashiCorp Vault or AWS Secrets Manager and reference them only at execution time
Restrict access to task logs and the underlying log storage backend using role-based access control and object storage policies until the upgrade is complete
Strip or redact existing task logs that may contain leaked secrets before rotating the affected credentials

bash

# Configuration example: upgrade Airflow and verify the installed version
pip install --upgrade "apache-airflow==2.10.3"
airflow version

# Restrict task log read access via RBAC role assignment
airflow roles list
airflow users remove-role --username analyst --role Op