CVE-2023-25956: Apache Airflow AWS Provider: Arbitrary file read via AWS provider

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-24 · updated 2026-06-17
Weakness: CWE-209

Description

Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.

Affected products

Apache Software Foundation Apache Airflow Amazon provider: before 7.2.1 — fixed in 7.2.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Airflow Amazon provider 7.2.1. Check the vendor advisory for mitigations.

References

https://github.com/apache/airflow/pull/29587
https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv
https://github.com/apache/airflow/pull/29587
https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv

Get alerted when CVE-2023-25956 or the next vulnerability affects your stack