CVE-2022-46651
Apache Airflow: Security vulnerability on AirFlow Connections
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
6.5
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
CVE-2022-46651- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-10
CVE List No score
Apache Airflow: Security vulnerability on AirFlow Connections
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
CVE-2022-46651- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-0009
0.0
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
EUVD-2023-0009- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xvw9-3mhm-xjqq
7.1
Apache Airflow information disclosure vulnerability
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
GHSA-xvw9-3mhm-xjqq- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-xvw9-3mhm-xjqq
7.1
Apache Airflow information disclosure vulnerability
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
GHSA-xvw9-3mhm-xjqq- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVBIT-airflow-2022-46651 No score
Apache Airflow: Security vulnerability on AirFlow Connections
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
BIT-airflow-2022-46651- Updated
- 2026-11-02
OSV No score
Apache Airflow: Security vulnerability on AirFlow Connections
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
CVE-2022-46651- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2023-103 No score
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
- Record
PYSEC-2023-103- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflowPyPI |
before 2.6.3 | 2.6.3 |
airflowBitnami |
before 2.6.3 | 2.6.3 |
apache-airflowPyPI |
before 2.6.3, plus listed versions 1.10.01.10.11.10.101.10.10rc11.10.10rc2 Show 45 moreShow less1.10.10rc31.10.10rc41.10.10rc51.10.111.10.11rc11.10.11rc21.10.121.10.12rc11.10.12rc21.10.12rc31.10.12rc41.10.131.10.13rc11.10.141.10.14rc11.10.14rc21.10.14rc31.10.14rc41.10.151.10.15rc11.10.1b11.10.1rc21.10.21.10.2b21.10.2rc11.10.2rc21.10.2rc31.10.31.10.3b11.10.3b21.10.3rc11.10.3rc21.10.41.10.4b21.10.4rc11.10.4rc21.10.4rc31.10.4rc41.10.4rc51.10.51.10.5rc11.10.61.10.6rc11.10.6rc21.10.7 |
2.6.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, facts | ||
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-46651 is a medium vulnerability (CVSS 6.5) in Apache Airflow, published July 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in apache-airflow 2.6.3.
References
github.com/apache/airflow/pull/32309
lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d
nvd.nist.gov/vuln/detail/CVE-2022-46651
github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-103.yaml
github.com/apache/airflow/commit/d01248382fe45a5f5a7fdeed4082a80c5f814ad8
github.com/advisories/GHSA-xvw9-3mhm-xjqq
github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46651.json
github.com/apache/airflow
Left out here: 106 versions. The JSON record has them.