H3-2022-0072¶

Apache Airflow Debug Mode Enabled

Description¶

The Apache Airflow instance is deployed in debug mode.

Impact¶

Attackers with access to Airflow's debug pin may execute arbitrary code, leading to data exfiltration and modification or malware.

References¶

• Project Discovery: Writing security templates for Apache Airflow
• CWE-215: Insertion of Sensitive Information Into Debugging Code