CVE-2024-31869: 
Apache Airflow vulnerability analysis and mitigation

Apache Airflow versions 2.7.0 through 2.8.4 contain a vulnerability (CVE-2024-31869) that allows authenticated users to view sensitive provider configuration through the 'configuration' UI page when 'non-sensitive-only' is set as 'webserver.expose_config' configuration. The vulnerability was discovered by Manmeet Rangoola and remediated by Jarek Potiuk (Apache Security, OSS Security).

The vulnerability specifically affects the configuration UI page when the 'webserver.expose_config' setting is set to 'non-sensitive-only'. Currently, the Celery provider is the only community provider that contains sensitive configurations that could be exposed through this vulnerability. The issue has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD Database).

The vulnerability allows authenticated users to access sensitive provider configuration information that should be restricted, particularly affecting the Celery provider's sensitive configurations. This exposure of sensitive information could potentially lead to security risks if the exposed configuration details are misused (OSS Security).

The vulnerability requires authentication to exploit, as it only affects authenticated users accessing the configuration UI page. The attack complexity is considered low, but privileged access is required (NVD Database).

Two mitigation options are available: 1) Upgrade to Apache Airflow 2.9 or later versions, which contain the fix for this vulnerability, or 2) Change the 'expose_config' configuration to False as a temporary workaround. This vulnerability is similar to but distinct from CVE-2023-46288, which concerned API rather than UI configuration page exposure (Apache PR).