Is CVE-2024-31869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-31869 being exploited in the wild.

How severe is CVE-2024-31869?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

Apache Airflow 2.7.0 through 2.8.4; apache-airflow (PyPI) ECOSYSTEM:introduced=2.7.0,fixed=2.9.0.

Is there a fix for CVE-2024-31869?

Yes. apache-airflow (PyPI): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-31869 attacked?

It is attacked over the network.

Am I affected by CVE-2024-31869?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-31869: PYSEC-2026-1128 - Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

CVE-2024-31869 · Severity: low · CVSS 3.1 · Published 2026-07-07

Apache Airflow is a widely-used workflow orchestration platform. A vulnerability in versions 2.7.0–2.8.4 allows authenticated users to view sensitive provider configuration (such as database credentials for the Celery provider) through the web UI's configuration page, even when configured to display only non-sensitive settings. An attacker with valid login credentials could expose secrets and potentially compromise integrated systems.

Technologies: Apache Airflow, apache-airflow (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2024-31869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-31869 being exploited in the wild.
How severe is CVE-2024-31869?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: Apache Airflow 2.7.0 through 2.8.4; apache-airflow (PyPI) ECOSYSTEM:introduced=2.7.0,fixed=2.9.0.
Is there a fix for CVE-2024-31869?: Yes. apache-airflow (PyPI): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-31869 attacked?: It is attacked over the network.
Am I affected by CVE-2024-31869?: Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 2.9.0 or later
```
pip install "apache-airflow>=2.9.0"
```

Technical details

A CWE-200 information disclosure vulnerability exists in Apache Airflow's configuration UI. When the "webserver.expose_config" setting is set to "non-sensitive-only", the web interface should filter out sensitive configuration values before display. However, the implementation fails to properly redact sensitive provider configurations in versions 2.7.0 through 2.8.4, allowing authenticated users to view secrets intended to be hidden. The vulnerability is specific to the web UI configuration page and differs from a related API disclosure (CVE-2023-46288). Exploitation requires valid Airflow user credentials and network access to the web interface. The issue has been resolved in Airflow 2.9.0 and later; temporary mitigation involves setting "expose_config" to False.

Affected products

Apache Airflow 2.7.0 through 2.8.4

Identifiers

CVE-2024-31869
GHSA-2522-mrjc-m688
PYSEC-2026-1128

Timeline

2024-04-18: disclosed
2024-04-06: patched: Fix merged in PR #38795; available in Airflow 2.9.0

References

https://github.com/apache/airflow/pull/38795

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.