CVE-2023-46288

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2). Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348.

• CWE-200

• http://www.openwall.com/lists/oss-security/2024/04/17/10
• https://github.com/apache/airflow/pull/32261Patch
• https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nwMailing List, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/04/17/10
• https://github.com/apache/airflow/pull/32261Patch
• https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nwMailing List, Patch, Vendor Advisory

Published

Oct 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46281A vulnerability has been identified in Opcenter Execution Fo…8.8
• CVE-2023-46282A vulnerability has been identified in Opcenter Execution Fo…6.1
• CVE-2023-46283A vulnerability has been identified in Opcenter Execution Fo…7.5
• CVE-2023-46284A vulnerability has been identified in Opcenter Execution Fo…7.5
• CVE-2023-46285A vulnerability has been identified in Opcenter Execution Fo…7.5
• CVE-2023-46287XSS exists in NagVis before 1.9.38 via the select function i…6.1
• CVE-2023-46289 Rockwell Automation FactoryTalk View Site Edition insuffici…7.5
• CVE-2023-4629The LadiApp plugin for WordPress is vulnerable to Cross-Site…4.3
• CVE-2023-46290 Due to inadequate code logic, a previously unauthenticated …8.1
• CVE-2023-46294An issue was discovered in Teledyne FLIR M300 2.00-19. User …3.4
• CVE-2023-46295An issue was discovered in Teledyne FLIR M300 2.00-19. Unaut…9.8
• CVE-2023-46297An issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_…5.1