CVE-2024-25142: Apache Airflow

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.  Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue.

Affected products

• Apache Airflow: before 2.9.2 (fixed in 2.9.2)

Published 2024-06-14. Last modified 2026-06-17.