Sensitive JWT tokens are exposed in Apache Airflow logs, allowing unauthorized users to potentially gain the permissions of Dag Authors.

This is an information disclosure vulnerability (CWE-532) where JWT tokens are incorrectly logged by the application. The CVSS vector indicates that this issue is exploitable by an unauthenticated attacker over the network.

The exposure of JWT tokens poses a significant risk to the integrity and confidentiality of the Airflow environment. By obtaining these tokens, an attacker could assume the identity of a Dag Author, leading to unauthorized workflow modifications or further system compromise. The CVSS score of 7.5 reflects a high severity, primarily due to the potential for unauthenticated access to sensitive session identifiers.

Immediate Action: Upgrade to Apache Airflow version 3.2.0 or later to ensure the logging mechanism no longer captures sensitive tokens.

Proactive Monitoring: Review existing log files and centralized logging systems for evidence of exposed JWT tokens and audit access logs for anomalous activity associated with Dag Author accounts.

Compensating Controls: Implement strict access controls on log files and utilize log masking or redaction services to prevent sensitive information from being stored in plaintext within logging infrastructure.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the critical nature of JWT tokens in session management, organizations using Apache Airflow must prioritize this update. Immediate patching to version 3.2.0 is the only effective way to prevent the continued leakage of credentials. Security teams should also perform an audit of historical logs to determine if any tokens were already compromised before the patch was applied.