Live › vulnerability › CVE-2024-25141
Go to dashboardWhen SSL is enabled in the Airflow MongoDB hook, the default settings allow insecure connections, so server certificates are not validated. An attacker positioned on the network path can impersonate the MongoDB server and intercept or alter the data and credentials passed over the connection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:11 UTC, 0h before NVD. All times on this page are UTC.
Teams running Apache Airflow with the MongoDB provider package below 4.0.0 that connect to MongoDB over SSL/TLS. The exposure depends on an attacker being able to sit on the network path between Airflow and the MongoDB server, so connections over trusted private networks carry lower practical risk. Teams not using the MongoDB provider can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow-providers-mongo | pypi | < 4.0.0 | 4.0.0 |
| apache apache-airflow-providers-mongo | vendor | >= 1.0.0, < 4.0.0 | 4.0.0 |
pip show apache-airflow-providers-mongo and check whether the version is below 4.0.0allow_insecure or tlsAllowInvalidCertificates setting in the Airflow connection configurationapache-airflow-providers-mongo to 4.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2024-25141")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.