You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "dabla (via GitHub)" <gi...@apache.org> on 2025/10/28 13:31:16 UTC
[I] Export of variables in Airflow has masked values instead of real ones [airflow]
dabla opened a new issue, #57428:
URL: https://github.com/apache/airflow/issues/57428
### Apache Airflow version
3.1.1
### If "Other Airflow 2/3 version" selected, which one?
_No response_
### What happened?
When you export variables through the Admin -> Variables page in Airflow, the actual exported values of the variables are masked and thus not really exported.
### What you think should happen instead?
The exported json file should contain the real values of the variables, not the masked ones as then the export would have no purpose. It works through the CLI though.
### How to reproduce
Just export variables via webserver Admin -> Variables
### Operating System
Linux
### Versions of Apache Airflow Providers
_No response_
### Deployment
Other 3rd-party Helm chart
### Deployment details
_No response_
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "dabla (via GitHub)" <gi...@apache.org>.
dabla commented on issue #57428:
URL: https://github.com/apache/airflow/issues/57428#issuecomment-3531174870
> > We definitely should include an admin check. But I'm wary about a default to show passwords, I think requiring manual action to do a less secure action is a good thing.
>
> Just to write it also here - my strong opinion here is that this is NOT what we agreed to as part of our security model. If we are to allow **any** remote user to see the content of sensitive values over the API (whether it's export API or any other) - we will have to change (or at the very least clarify) in our agreed model. Previously people ([@ashb](https://github.com/ashb) particularly) were very strong that making such sensitive information via API is not a good idea. We clarified it in the model, implemented specific changes to always mask such sensitive values and handle "write-only" model for such sensitive data (i.e. no remote user should be able to read stored sensiitive data).
>
> In Airflow 2 we had different philosophy - Airflow API users with "edit" capability could see that password. This has been changed by [@ashb](https://github.com/ashb) and [@pierrejeambrun](https://github.com/pierrejeambrun)'s implementation in 3.0 - but it has not been captured as a model change, and in Airflow 3.0.3 we implemented a change that revealed those passwords (fixing overriding of passwords when editing connection) and that caused a strong push-back from [@ashb](https://github.com/ashb) and discussion in the security team that led to changing it in 3.0.4 to mask all passwords, updating our security model to describe it and issuing this advisory to our users: https://www.cvedetails.com/cve/CVE-2025-54831/
>
> I think it's a good idea - before any security relatead change is discussed to follow it in the way that we do not repeat the same mistake. Discuss it with security team first ([security@airlfow.apache.org](mailto:security@airlfow.apache.org)) after consulting a security model.
>
> Yes. We can change a security model if we agreee to it, but this is not something that should happen in "issue" or "pr" and certainly its something that should be discussed and agreed with the security team - because ultimately it's the security team that has to handle any violations of the security model agreed.
>
> My current proposal - which I am going to propose tomorrow at the devlist which is a result of similar discussion in the security team is that we completely remove at least "export" functionality and only allow export by local CLI user - not by remote API user. But I am open to a discussion and **devlist** agreement if we decide to change the model and allow admin user to do it (however we do not have a dedicated "admin" capabilty now - currently we have predefined set of roles and "Admin" user is **just** one of the roles, so if we want to something like that we would likely need to add EXPORT capabilty and grant such capability to Admin user by default. But let's discuss it in the devlist tomorrow.
I agree with removal of export functionality in UI, as it doesn't make sense to export masked secrets in variables (or connections) anyways and this is indeed a possible vulnerability.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "steveahnahn (via GitHub)" <gi...@apache.org>.
steveahnahn commented on issue #57428:
URL: https://github.com/apache/airflow/issues/57428#issuecomment-3470995033
Opened a PR that requires OP level rights and unmasks the values by default on an export
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "dabla (via GitHub)" <gi...@apache.org>.
dabla commented on issue #57428:
URL: https://github.com/apache/airflow/issues/57428#issuecomment-3469379408
I personally think the feature should only be available if the logged in user has admin rights, and then by default unmask it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #57428:
URL: https://github.com/apache/airflow/issues/57428#issuecomment-3478074869
> We definitely should include an admin check. But I'm wary about a default to show passwords, I think requiring manual action to do a less secure action is a good thing.
Just to write it also here - my strong opinion here is that this is NOT what we agreed to as part of our security model. If we are to allow **any** remote user to see the content of sensitive values over the API (whether it's export API or any other) - we will have to change our agreed model. Previously people (@ashb particularly) were very strong that making such sensitive information via API is not a good idea. We clarified it in the model, implemented specific changes to always mask such sensitive values and handle "write-only" model for such sensitive data (i.e. no remote user should be able to read stored sensiitive data).
In Airflow 2 we had different philosophy - Airflow API users with "edit" capability could see that password. This has been changed by @ashb and @pierrejeambrun's implementation - but it has not been captured as a model change, and in Airflow 3.0.3 we implemented a change that revealed those passwords (fixing overriding of passwords when editing connection) and that caused a strong push-back from @ashb and discussion in the security team that led to changing it in 3.0.4 to mask all passwords, updating our security model to describe it and issuing this advisory to our users: https://www.cvedetails.com/cve/CVE-2025-54831/
I think it's a good idea - before any security relatead change is discussed to follow it in the way that we do not repeat the same mistake. Discuss it with security team first (security@airlfow.apache.org) after consulting a security model. Yes. We can change a security model if we agreee to it, but this is not something that should happen in "issue" or "pr" and certainly its something that should be discussed and agreed with the security team - because ultimately it's the security team that has to handle any violations of the security model agreed.
My current proposal - which I am going to propose tomorrow at the devlist which is a result of similar discussion in the security team is that we completely remove at least "export" functionality and only allow export by local CLI user - not by remote API user. But I am open to a discussion and **devlist** agreement if we decide to change the model and allow admin user to do it (however we do not have a dedicated "admin" capabilty now - currently we have predefined set of roles and "Admin" user is **just** one of the roles, so if we want to something like that we would likely need to add EXPORT capabilty and grant such capability to Admin user by default. But let's discuss it in the devlist tomorrow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed issue #57428: Export of variables in Airflow has masked values instead of real ones
URL: https://github.com/apache/airflow/issues/57428
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "amoghrajesh (via GitHub)" <gi...@apache.org>.
amoghrajesh commented on issue #57428:
URL: https://github.com/apache/airflow/issues/57428#issuecomment-3460148050
Thanks for reporting @dabla!
In Airflow 3, the UI uses the same Airflow Rest API and all the endpoints in the rest API are secure, ie. they do not return passwords etc in plain text. With that said, this was not an intentional decision to mask on the UI but it just seems to have accidentally broken that feature (airflow 2 was different) of importing variables from the UI.
I think this requires some more decision on what's the best way to approach this problem. Either we do not allow importing / exporting from UI (too rough) or deal differently. cc @pierrejeambrun / @bbovenzi if you have any inputs
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi commented on issue #57428:
URL: https://github.com/apache/airflow/issues/57428#issuecomment-3469658393
We definitely should include an admin check. But I'm wary about a default to show passwords, I think requiring manual action to do a less secure action is a good thing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Export of variables in Airflow has masked values instead of real ones [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi commented on issue #57428:
URL: https://github.com/apache/airflow/issues/57428#issuecomment-3468774622
Maybe add a param to the API endpoint to mask or unmask?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org