What is CVE-2023-51702?

CVE-2023-51702 is a medium-severity vulnerability in Apache Airflow, classified under Cleartext Storage of Sensitive Information. CVSS score: 6.5/10. Published 2024-01-24.

How severe is CVE-2023-51702?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in Apache Airflow

CVE-2023-51702

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.

Published 2024-01-24 · last modified 2026-07-02.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.004 (29.9th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 29.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Apache Airflow
Apache Airflow Cncf Kubernetes
Apache Apache-Airflow-Providers-Cncf-Kubernetes
Apache Software Foundation Airflow — versions 2.3.0
Apache Software Foundation Airflow Cncf Kubernetes Provider — versions 5.2.0

Weakness classification (CWE)

References

github.com/apache/airflow/pull/29498 (Patch, patch, Issue Tracking)
github.com/apache/airflow/pull/30110 (Patch, patch)
github.com/apache/airflow/pull/36492 (Patch, patch, Issue Tracking)
lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9 (vendor-advisory, Mailing List, Vendor Advisory)
www.openwall.com/lists/oss-security/2024/01/24/3 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-51702?: CVE-2023-51702 is a medium-severity vulnerability in Apache Airflow, classified under Cleartext Storage of Sensitive Information. CVSS score: 6.5/10. Published 2024-01-24.
How severe is CVE-2023-51702?: Medium severity. CVSS v3 base score is 6.5 out of 10.