Researchers at Intezer, a security firm based in New York, recently unveiled details of a misconfigured flaw in Apache Airflow as well as some well-known companies that have instances that have been exposing sensitive information. Apache Airflow is a popular “open-source workflow management platform” that has five main features: Directed Acyclic Graph (DAG), Task, Variables, Connections, and Logs. The researchers detailed that the main risk associated to a misconfigured instance is credential exposure. The exposure from the approximately twenty (20) popular platforms, which are identified in the published report linked below, include database passwords, API keys, and cloud credentials. The Intezer researchers also detailed that the flawed instances “expose sensitive information of companies across the media, finance, manufacturing, information technology (IT), biotech, e-commerce, health, energy, cybersecurity, and transportation industries”. The following at the five (5) main methods in which credentials have been exposed. The first method is through “insecure coding practices”, where many instances have hardcoded sensitive passwords inside of the Python DAG code. The second method is through variables, where a global variable contains hardcoded passwords. The third method is through connections. Connections are where the user would store credentials correctly, but instances have been identified to have credentials stored in the “Extra” field in plaintext, which is not encrypted like the rest of the fields and can be widely viewed. The fourth method is through logs, where a vulnerability lies. CVE-2020-17511, which is present in Airflow versions prior to 1.10.13, allows for credentials added to the instance via the command line interface (CLI) to be logged in the logs section as plaintext. The final method is through the configuration file (airflow.cfg) which holds credentials such as passwords and keys. Researchers detailed that “if the setting in the file “expose_config” is set to “True”, anyone can access the configuration from the web server UI”. The misconfiguration of Airflow instances can lead to violations of data protection laws, such as the General Data Protection Regulation (GDPR), as well as malicious code execution/malware invading the exposed environments or flawed platform. Intezer has provided mitigation details at the conclusion of their report and advise that all Airflow instances be updated to the latest version as well as ensure that specific, authorized users connect to the instance only.