CVE-2024-25141 Improper Certificate Validation in apache airflow mongo hook
Attackers can bypass SSL certificate validation in Apache Airflow Mongo Provider when SSL is enabled, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-25141?
CVE-2024-25141 is a critical vulnerability in Apache Airflow Mongo Provider, published on 20 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.
Weakness: CWE-295
Which versions are affected by CVE-2024-25141?
3 open source packages ship an affected version, including apache-airflow-providers-mongo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow-providers-mongo PyPI | All versions | 4.0.0 |
apache-airflow-providers-mongo PyPI | All versions | 4.0.0 |
apache-airflow-providers-mongo PyPI | All versions | 4.0.0 |
Products include Apache Apache-Airflow-Providers-Mongo.
How do I fix CVE-2024-25141?
Upgrade apache-airflow-providers-mongo to 4.0.0 or later.
Is CVE-2024-25141 being exploited?
There is no known exploitation of CVE-2024-25141 in the wild and no public exploit code.
Sources
Also known as GHSA-x5pm-h33q-cjrw, PYSEC-2026-278.