GHSA-59x3-x3hh-x23qMediumCVSS 6.5
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra,...
🔗 CVE IDs covered (1)
📋 Description
The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.
Users are advised to upgrade to apache-airflow 3.4.0 or later.