You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "carlos54 (via GitHub)" <gi...@apache.org> on 2026/03/23 10:55:43 UTC

[I] [SECURITY] Cleartext Credential Leakage in Airflow DAG Bundles Git Configuration [airflow]

carlos54 opened a new issue, #64099:
URL: https://github.com/apache/airflow/issues/64099

   ### Description
   
   Hello Apache Airflow Team,
   
   When configuring a Git-based DAG bundle in Airflow using git bundle connexions, the underlying synchronization mechanism constructs the repository URL by embedding the username and token/password directly into the connection string (e.g., https://<user>:<token>@<host>/<repo>.git).
   
   So developer without any administrative privileges can exfiltrate these tokens during the DAG parsing phase (DagProcessor pod).
   
   
   File with git credential:
   ```
   sh-5.1$ cat   /dags/sandbox/bare/config
   ...
   [remote "origin"]
           url = https://airflow_cen:<CLEARTEXT_TOKEN>@gitlab.ctie.etat.lu/pibi/airflow-projects/sandbox-dags.git
   ```
   
   
   ### Use case/motivation
   
   To prevent access to plaintext passwords, even if DAG authors can access all databases without going through DAG processing scans, the passwords are normally encrypted.
   
   ### Related issues
   
   https://github.com/apache/airflow/security/advisories/GHSA-qhqv-64px-4339https://github.com/apache/airflow/security/advisories/GHSA-qhqv-64px-4339
   
   ### Are you willing to submit a PR?
   
   - [x] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Cleartext Credential stored locally in Airflow DAG Bundles Git Configuration [airflow]

Posted by "shahar1 (via GitHub)" <gi...@apache.org>.
shahar1 closed issue #64099: Cleartext Credential stored locally in Airflow DAG Bundles Git Configuration
URL: https://github.com/apache/airflow/issues/64099


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [SECURITY] Cleartext Credential Leakage in Airflow DAG Bundles Git Configuration [airflow]

Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #64099:
URL: https://github.com/apache/airflow/issues/64099#issuecomment-4112149407

   Just to be very clear to bystanding users - this isnot a security vulnerability - it's just security improvement to be added.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Cleartext Credential stored locally in Airflow DAG Bundles Git Configuration [airflow]

Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #64099:
URL: https://github.com/apache/airflow/issues/64099#issuecomment-4112171422

   I updated description and title accordingly


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Cleartext Credential stored locally in Airflow DAG Bundles Git Configuration [airflow]

Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #64099:
URL: https://github.com/apache/airflow/issues/64099#issuecomment-4112199988

   We should avoid scaring people unnecessarily :)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org