-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from case-sensitive handling of configuration keys. The original implementation in config_endpoint.py's get_value method checked (section, option) against sensitive_config_values without case normalization, allowing bypass via mixed-case requests. The configuration.py's sensitive_config_values property stored keys with original casing rather than normalized lowercase. The patch explicitly lowercases both the input parameters and stored sensitive keys to ensure case-insensitive matching. The test cases added in test_config_endpoint.py demonstrate this by verifying various casing combinations are properly redacted after the fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |