CVE-2023-46215

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.

Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs.

This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.

Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-462169.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462179.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462186.5This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allCVE-2023-462195.3When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file CVE-2023-46227.0A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_sCVE-2023-462209.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462219.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462229.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462239.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462249.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462259.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462269.8Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upg
CVE-2023-46215: High severity, CVSS 7.5 | Vulnix