CVE-2023-40712

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.

• CWE-200

• https://github.com/apache/airflow/pull/33512Vendor Advisory
• https://github.com/apache/airflow/pull/33516Vendor Advisory
• https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2btsMailing List, Vendor Advisory
• https://github.com/apache/airflow/pull/33512Vendor Advisory
• https://github.com/apache/airflow/pull/33516Vendor Advisory
• https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2btsMailing List, Vendor Advisory

Published

Sep 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40707There are no requirements for setting a complex password in …7.5
• CVE-2023-40708The File Transfer Protocol (FTP) port is open by default in …5.3
• CVE-2023-40709An adversary could crash the entire device by sending a larg…7.5
• CVE-2023-4071Heap buffer overflow in Visuals in Google Chrome prior to 11…8.8
• CVE-2023-40710An adversary could cause a continuous restart loop to the en…7.5
• CVE-2023-40711Veilid before 0.1.9 does not check the size of uncompressed …7.5
• CVE-2023-40714A relative path traversal in Fortinet FortiSIEM versions 7.0…8.8
• CVE-2023-40715A cleartext storage of sensitive information vulnerability […5.5
• CVE-2023-40716An improper neutralization of special elements used in an OS…7.8
• CVE-2023-40717A use of hard-coded credentials vulnerability [CWE-798] in F…7.8
• CVE-2023-40718A interpretation conflict in Fortinet IPS Engine versions 7.…7.5
• CVE-2023-40719A use of hard-coded credentials vulnerability in Fortinet Fo…5.5