CVE-2022-27949

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.

• CWE-200

• http://www.openwall.com/lists/oss-security/2022/11/14/3Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/22754Patch, Third Party Advisory
• https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65pMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/11/14/3Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/22754Patch, Third Party Advisory
• https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65pMailing List, Vendor Advisory

Published

Nov 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-27943libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consu…5.5
• CVE-2022-27944Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 …7.5
• CVE-2022-27945NETGEAR R8500 1.0.2.158 devices allow remote authenticated u…8.8
• CVE-2022-27946NETGEAR R8500 1.0.2.158 devices allow remote authenticated u…8.8
• CVE-2022-27947NETGEAR R8500 1.0.2.158 devices allow remote authenticated u…8.8
• CVE-2022-27948Certain Tesla vehicles through 2022-03-26 allow attackers to…4.3
• CVE-2022-2795By flooding the target resolver with queries exploiting this…5.3
• CVE-2022-27950In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11,…5.5
• CVE-2022-27952An arbitrary file upload vulnerability in the file upload mo…9.8
• CVE-2022-27958Insecure permissions configured in the userid parameter at /…5.4
• CVE-2022-2796Cross-site Scripting (XSS) - Stored in GitHub repository pim…4.8
• CVE-2022-27960Insecure permissions configured in the user_id parameter at …5.4