CVE-2023-46215

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.

• CWE-532

• http://www.openwall.com/lists/oss-security/2023/10/28/1Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/34954Patch
• https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46nMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/10/28/1Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/34954Patch
• https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46nMailing List, Vendor Advisory

Published

Oct 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4621Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-46210Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-46211Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-46212Missing Authorization, Cross-Site Request Forgery (CSRF) vul…8.8
• CVE-2023-46213In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffec…4.8
• CVE-2023-46214In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk …8.8
• CVE-2023-46216An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-46217An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-46218This flaw allows a malicious HTTP server to set "super cooki…6.5
• CVE-2023-46219When saving HSTS data to an excessively long file name, curl…5.3
• CVE-2023-4622A use-after-free vulnerability in the Linux kernel's af_unix…7
• CVE-2023-46220An attacker sending specially crafted data packets to the Mo…9.8