CVE-2023-35005

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

• CWE-200

• https://github.com/apache/airflow/pull/31788Patch
• https://github.com/apache/airflow/pull/31820Issue Tracking
• https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjdMailing List, Vendor Advisory
• https://github.com/apache/airflow/pull/31788Patch
• https://github.com/apache/airflow/pull/31820Issue Tracking
• https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjdMailing List, Vendor Advisory

Published

Jun 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34999A command injection vulnerability exists in RTS VLink Virtua…7.2
• CVE-2023-3500An issue has been discovered in GitLab CE/EE affecting all v…6.1
• CVE-2023-35001Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability…7.8
• CVE-2023-35002A heap-based buffer overflow vulnerability exists in the pic…9.8
• CVE-2023-35003Path transversal in some Intel(R) VROC software before versi…7.8
• CVE-2023-35004An integer overflow vulnerability exists in the VZT longest_…7.8
• CVE-2023-35006IBM Security QRadar EDR 3.12 is vulnerable to HTML injection…5.4
• CVE-2023-35009IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow …5.3
• CVE-2023-3501The FormCraft WordPress plugin before 1.2.7 does not sanitis…4.8
• CVE-2023-35011IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerabl…5.4
• CVE-2023-35012IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Se…6.7
• CVE-2023-35013IBM Security Verify Governance 10.0, Identity Manager could …4.4