Secrets-Backend Credentials Exposure in Apache Airflow Config API

Executive Summary

This vulnerability in Apache Airflow involves the Config API exposing sensitive secrets-backend credentials in plaintext. Specifically, environment variables used for per-key secrets-backend overrides, such as AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID and AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID, were not properly masked because their option names were not included in the list of sensitive configuration values. As a result, an authenticated user with Config read permission could retrieve these secret credentials from the API output.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an authenticated user with permission to read configuration via the UI or API could access plaintext secrets-backend credentials. This exposure could lead to unauthorized access to secret management systems like Vault, potentially allowing attackers to escalate privileges, access sensitive data, or compromise the security of the Airflow deployment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the exposure of plaintext secrets-backend credentials through the Apache Airflow Config API when per-key environment variable overrides are used. Detection involves checking if the Config API responses include unmasked sensitive environment variables such as AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID or AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID.

You can detect this by querying the Config API endpoints (e.g., GET /config or GET /config/section/{section}/option/{option}) as an authenticated user with Config read permission and inspecting the output for any plaintext secrets-backend credentials.

No specific commands are provided in the available resources, but a typical approach would be to use curl or similar HTTP clients to request the configuration API endpoints and grep or search the output for the sensitive environment variable patterns.

• Example command to check the config API output: curl -u <user>:<password> http://<airflow-host>/api/v1/config | grep SECRET_ID

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Apache Airflow to version 3.3.0 or later, where this vulnerability has been fixed by properly masking the sensitive per-key environment variable overrides in the Config API responses.

If upgrading immediately is not possible, restrict Config API access to only trusted and authenticated users with minimal permissions, especially limiting Config read permission to prevent unauthorized retrieval of secrets.

Review and audit environment variable usage for secrets backend configuration to minimize exposure and consider alternative secret management approaches that do not rely on per-key environment variable overrides.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with Config read permission to retrieve plaintext secrets-backend credentials from the Config API output. Such exposure of sensitive credentials could lead to unauthorized access to protected data or systems.

Exposure of sensitive secrets and credentials in plaintext may violate data protection and security requirements outlined in common standards and regulations such as GDPR and HIPAA, which mandate proper protection and confidentiality of sensitive information.

Therefore, deployments affected by this vulnerability may face compliance risks if the exposed secrets lead to unauthorized data access or breaches.

Users are advised to upgrade to Apache Airflow 3.3.0 or later, where the issue is fixed by properly masking these sensitive configuration values.

Useful 0 Not Useful 0